OPENSUSE-SU-2026:11528-1 wasm-bindgen-0.2.100-2.1 on GA media

These are all security issues fixed in the wasm-bindgen-0.2.100-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76454

These are all security issues fixed in the wasm-bindgen-0.2.100-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11522-1 obs-service-cargo-7.2.2-2.1 on GA media

These are all security issues fixed in the obs-service-cargo-7.2.2-2.1 package on the GA media of openSUSE Tumbleweed...

keyhog v0.5.73-action

Website · Documentation · Architecture · Vyre GPU engine KeyHog: GPU-accelerated secret scanner for code, cloud, and CI KeyHog is an open-source secret scanner in Rust that finds and verifies leaked API keys, tokens, passwords, and credentials across source code, Git history, containers, cloud...

byterag-core (0.3.0), byterag-ffi (0.3.0) +7 more potentially affected by CVE-2026-10740 via s2n-quic (1.37.0)

s2n-quic CARGO version 1.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on s2n-quic and may be impacted: - byterag-core 0.3.0 - byterag-ffi 0.3.0 - cryprot-net 0.1.0 - dbx-core =0.2.0-beta, =0.2.0-beta, =0.10.0, =0.1.0, =0.1.0, =0.2.2, =0.3.0 Source...

cottage v0.6.7

cott age is a GitOps tool for teams to manage age-encrypted secrets in git repositories. It provides a simple workflow to encrypt/decrypt secrets, manage recipients, and keep secrets out of the repo while still allowing for easy sharing via VCS. cottage also generates redacted previews of encrypt...

AZL-96734 CVE-2026-49263 affecting package rust for versions less than 1.75.0-30

Capstone is a disassembly framework. Prior to version 6.0.0-Alpha9, Capstone's WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the public csdisasm and csdisasmiter APIs. For a large but well-formed brtable instruction, the WASM decoder accumulates the immediate...

CVE-2026-72814

The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...

CVE-2026-72814

The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...

CVE-2026-72814

The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. If serve_from is a non-existing folder in Files::new(), the mount path becomes empty and the service joins and canonicalizes the request path against this empty path, causing Rust to treat it...

EUVD-2026-58629

The actix-files crate actixfiles before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the servefrom argument to Files::new, the mount path defaults to an empty path; the service then joins the request path with this empty path and...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: uv, linkerd-extension-init, ztunnel, nushell, linkerd2-proxy, cargo-audit, wasmcloud, wasmtime, pixi, sqlx, sdp-k8s-injector, zed, atuin, buck2, parseable, ntpd-rs, zizmor, oranda, kdash, rustup, wash, samply, rustls-ffi, rye, shadowsocks-rust, zola, qdrant, tealdeer...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: lychee, shadowsocks-rust, zola, rustup, rye, samply, tealdeer, linkerd2-proxy, wasm-pack, deno, nushell, linkerd-extension-init, ntpd-rs, parseable, wasmtime, kdash, wasmcloud, buck2, wadm, uv, xh, zed, sccache, zizmor, atuin, oranda, rustls-ffi, sdp-k8s-injector,...

dirsearch v0.5.0

dirsearch - Web Path Discovery An advanced web path brute-forcer dirsearch is being actively developed by @maurosoria and @shelld3v. Join the Discord server to communicate with the team. Quick Start dirsearch requires Python 3.11 or higher. root@kitploit: git clone...

CVE-2026-73489

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service by sending a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry...

CVE-2026-73489

Summary: CVE-2026-73489 affects russh (Rust SSH library) prior to 0.62.4. An authenticated SSH client can trigger a denial-of-service by sending a pty-req channel request with more than 130 terminal-mode records. The parser uses a fixed 130-entry array for terminal modes but increments the index ...

dalfox v3.2.1

Looking for the Go v2.x version? Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the v2 branch and continues to receive security backports. See SECURITY.md for the support policy. Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickl...

AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS

Cybersecurity researchers have disclosed details of a new macOS-oriented, Rust-based information stealer called AmnesiaStealer that's capable of hijacking Chromium web browsers to steal session data. The multi-stage stealer is spread via a counterfeit GitHub download page titled "Download for...

Armored Likho expands its cyber-espionage toolkit

In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake...

SUSE SLES15: himmelblau / himmelblau-sshd-config / himmelblau-sso / etc (SUSE-SU-2026:3576-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3576-1 advisory. Security fixes: - CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1...