Tagged “rust”
CVEs tagged rust, newest first.
715 CVEsRSS
CVE-2026-35339Medium· 5.5chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)
chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)
CVE-2026-35338High· 7.3chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)
chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)
GHSA-2v8p-fqpx-2q3wMedium· 6.2jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)
jxl-oxide: integer subtraction overflow panic in cluster_from_table via crafted JXL input (DoS)
GHSA-66m8-c62j-h6v5Medium· 6.2jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
jxl-oxide: `FrameBuffer::new` creates out-of-bounds slices on overflow
GHSA-h72h-ppcx-998pLow· 3.7Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length
Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length
GHSA-443g-gwgp-49x4Low· 3.7zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length
zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length
GHSA-c8w6-x74f-vmg3Medium· 6.5zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers
zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers
CVE-2026-50185MediumCmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
CVE-2026-63760High· 7.5SurrealDB has Denial of Service in JSON parser due to nested objects
SurrealDB has Denial of Service in JSON parser due to nested objects
CVE-2026-63758Medium· 5.4SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries
CVE-2026-63743Medium· 6.4SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
CVE-2026-63748Medium· 4.3SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
GHSA-6g9v-7gq3-p2c6Medium· 4.3SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
GHSA-fpxg-5xmv-922mMedium· 4.3SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
GHSA-f82j-v89j-mf86Medium· 4.3SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
GHSA-6wqw-vhfr-9999Medium· 4.3SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
GHSA-97vg-427p-8hx5Medium· 6.4SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect
GHSA-wp87-mgvq-5j93Medium· 6.5SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
GHSA-c8jx-96c9-8xrpMedium· 4.3SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths
GHSA-fwg2-gr34-q3w8Medium· 4.3SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
CVE-2026-49997Medium· 5.4SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted
GHSA-5qfp-32cf-69jhHigh· 8.8SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
GHSA-4vgr-h27g-cf9pHigh· 8.1SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
GHSA-q729-696q-g9pqHigh· 7.5SurrealDB has Denial of Service in JSON parser due to nested objects
SurrealDB has Denial of Service in JSON parser due to nested objects
GHSA-wjjj-24cx-f28gHigh· 7.5SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
GHSA-q8qp-67f9-wr3fMedium· 6.5SurrealDB vulnerable to Denial of Service due to nested types annotations
SurrealDB vulnerable to Denial of Service due to nested types annotations
GHSA-98fx-66cf-fc7cMedium· 6.5SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level
SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level
GHSA-vjjx-rfw4-rmfcMedium· 6.5SurrealDB: Graph traversal bypasses table SELECT permissions
SurrealDB: Graph traversal bypasses table SELECT permissions
GHSA-6vg3-hgrw-p5gfMedium· 5.4SurrealDB has an Authorization Bypass via Composite Record-id Paths
SurrealDB has an Authorization Bypass via Composite Record-id Paths
GHSA-4v76-cw68-4vc9Medium· 6.5SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required
SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required