RUSTSEC-2025-0059 servo-fontconfig crate is unmaintained

The servo-fontconfig crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives - fontconfig-rs...

accesskit_windows (>=0.5.0, <=0.10.4), accesskit_winit (>=0.2.0, <=0.8.1) +283 more potentially affected by unknown CVE via servo-fontconfig (>=0.4.0, <=0.5.1)

servo-fontconfig CARGO version =0.4.0, =0.5.0, =0.2.0, =0.5.0, =0.5.0, =0.1.0, =0.8.0, =0.8.0, =0.4.0, =0.6.0, =0.12.7, =0.19.3, =0.3.0, =0.3.5 - ash-tray 0.19.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0059...

PT-2025-38471

The iron crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives See this comparison for popular alternatives...

aa2nucaln (0.1.1), agent-stream-kit (>=0.9.0, <=0.14.0) +373 more potentially affected by unknown CVE via custom_derive (0.1.7)

customderive CARGO version 0.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on customderive and may be impacted: - aa2nucaln 0.1.1 - agent-stream-kit =0.9.0, =0.4.0, =0.1.1, =0.2.0, =0.1.0, =0.1.0, =3.1.3, =0.3.7, =0.1.0, =0.1.0, =0.1.2 and more Sour...

advisory-db

This is a security advisory database repository for Rust crates published via crates.io. The repository contains a collection of security advisories filed against various Rust crates, with each advisory containing information in TOML format. The advisories are categorized by crate name, and each...

advisory-db

This is a security advisory database for Rust crates published through crates.io. The database is stored in TOML format and contains information about security advisories filed against various Rust crates. The advisories include details such as the affected package, patched versions, and a...

SUSE-SU-2025:03092-1 Security update for rav1e

This update for rav1e fixes the following issues: - Update crate shlex to 1.3.0: CVE-2024-58266: Fixed command injection bsc1247207 RUSTSEC-2024-0006: Fixed multiple issues involving quote API bsc1230028...

CVE-2025-53605 affecting package rust for versions less than 1.75.0-17

CVE-2025-53605 affecting package rust for versions less than 1.75.0-17. A patched version of the package is available...

CVE-2025-53605 affecting package rust for versions less than 1.86.0-4

CVE-2025-53605 affecting package rust for versions less than 1.86.0-4. A patched version of the package is available...

a2d (>=0.1.0, <=0.1.11), aa2nucaln (0.1.1) +2179 more potentially affected by unknown CVE via fxhash (>=0.1.2, <=0.2.1)

fxhash CARGO version =0.1.2, =0.1.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1-dev.10, =0.1.0, =0.37.1, =0.1.1, =0.0.1, =0.1.1, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0057...

a2d (>=0.1.0, <=0.1.11), abscissa (>=0.6.0-beta.1, <=0.6.0-rc.0) +1101 more potentially affected by unknown CVE via adler (>=0.2.3, <=1.0.2)

adler CARGO version =0.2.3, =0.1.0, =0.6.0-beta.1, =0.6.0-beta.1, =0.6.0-beta.1, =0.1.5, =0.0.1-dev.10, =0.4.0, =0.2.0, =0.1.0, =0.2.0, =0.1.13, =0.1.0, =0.3.0, =0.1.0, =0.9.1, =0.13.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0056...

Rust Privilege Escalation

The vulnerability of the Rust programming language is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges...

CVE-2025-58359 frost-core: refresh shares with smaller min_signers will reduce group security

ZF FROST is a Rust implementation of FROST Flexible Round-Optimised Schnorr Threshold signatures. In versions 2.0.0 through 2.1.0, refresh shares with smaller minsigners will reduce security of group. The inability to change minsigners i.e. the threshold with the refresh share functionality...

The protobuf crate before 3.7.2 for Rust allows uncontrolled recursion in the protobuf::coded_input_stream::CodedInputStream::skip_group parsing of unknown fields in untrusted input.

...

The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \xa0 characters, which may facilitate command injection.

...

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.

...

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.

...

Rust-openssl: rust-openssl use-after-free in `md::fetch` and `cipher::fetch`

...

CVE-2025-57611

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 Null pointer dereference vulnerability in the dump method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check the return value of avfiltergraphdump for NULL, leading to a crash...

CVE-2025-57612

An issue was discovered in rust-ffmpeg 0.3.0 after comit 5ac0527 Null pointer dereference vulnerability in the name method allows an attacker to cause a denial of service. The vulnerability exists because the method fails to check for a NULL return value from the avgetsamplefmtname C function,...