RUSTSEC-2025-0066 The `google-apis-rs` project is now unmaintained

Instead, please start using and migrate to the official Google Rust bindings...

The `google-apis-rs` project is now unmaintained

Instead, please start using and migrate to the official Google Rust bindings...

RUSTSEC-2025-0059 servo-fontconfig crate is unmaintained

The servo-fontconfig crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives - fontconfig-rs...

RUSTSEC-2025-0061 iron crate is unmaintained

The iron crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives See this comparison for popular alternatives...

iron crate is unmaintained

The iron crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives See this comparison for popular alternatives...

advisory-db

This is a security advisory database repository for Rust crates published via crates.io. The repository contains a collection of security advisories filed against various Rust crates, with each advisory containing information in TOML format. The advisories are categorized by crate name, and each...

advisory-db

This is a security advisory database for Rust crates published through crates.io. The database is stored in TOML format and contains information about security advisories filed against various Rust crates. The advisories include details such as the affected package, patched versions, and a...

SUSE-SU-2025:03092-1 Security update for rav1e

This update for rav1e fixes the following issues: - Update crate shlex to 1.3.0: CVE-2024-58266: Fixed command injection bsc1247207 RUSTSEC-2024-0006: Fixed multiple issues involving quote API bsc1230028...

CVE-2025-53605 affecting package rust for versions less than 1.75.0-17

CVE-2025-53605 affecting package rust for versions less than 1.75.0-17. A patched version of the package is available...

CVE-2025-53605 affecting package rust for versions less than 1.86.0-4

CVE-2025-53605 affecting package rust for versions less than 1.86.0-4. A patched version of the package is available...

The vulnerability of the Rust programming language, related to incorrect privilege assignment, allows attackers to elevate their privileges.

The vulnerability of the Rust programming language is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2025-58359 frost-core: refresh shares with smaller min_signers will reduce group security

ZF FROST is a Rust implementation of FROST Flexible Round-Optimised Schnorr Threshold signatures. In versions 2.0.0 through 2.1.0, refresh shares with smaller minsigners will reduce security of group. The inability to change minsigners i.e. the threshold with the refresh share functionality...

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

...

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

...

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.

...

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

...

Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

...

CVE-2025-57611

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 Null pointer dereference vulnerability in the dump method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check the return value of avfiltergraphdump for NULL, leading to a crash...

CVE-2025-57615

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 An integer overflow vulnerability in the Vector::new constructor function allows an attacker to cause a denial of service via a null pointer dereference. The vulnerability stems from an unchecked cast of a usize parameter to cint,...

CVE-2025-57612

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 Null pointer dereference vulnerability in the name method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check for a NULL return value from the avgetsamplefmtname C function,...