Tagged “rust”
CVEs tagged rust, newest first.
740 CVEsRSS
CVE-2026-55448Medium· 6.3Mise's local credential_command executes untrusted config
Mise's local credential_command executes untrusted config
CVE-2026-33646Critical· 9.6Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)
GHSA-74p7-6h78-gw8pHighskillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery
skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery
RUSTSEC-2026-0187High· 7.5Stack overflow in lopdf via deeply nested PDF objects
Stack overflow in lopdf via deeply nested PDF objects
CVE-2026-63744Medium· 4.1SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch
SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch
CVE-2026-63737Medium· 6.5SurrealDB: Denial of Service via deep operator chains
SurrealDB: Denial of Service via deep operator chains
CVE-2026-63739High· 7.7SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
CVE-2026-63309Medium· 4.3SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
CVE-2026-63738Medium· 4.3SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
CVE-2026-11941Medium· 5.6Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions
Cloudflare Quiche: Use-after-free in connection ID iterator FFI functions
GHSA-h5rg-8p7f-47g2Medium· 4.1SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch
SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch
GHSA-cc8f-fcx3-gpjrHigh· 7.7SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
GHSA-h4h3-3rfj-x6fqMedium· 4.3SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field
GHSA-hv6h-hc26-q48pMedium· 4.3SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals
GHSA-jv2j-mqmw-xvv5Medium· 6.5SurrealDB: Denial of Service via deep operator chains
SurrealDB: Denial of Service via deep operator chains
CVE-2026-49859Medium· 5.2Deno: `fetch()` API sandbox bypass via missing DNS resolution check
Deno: `fetch()` API sandbox bypass via missing DNS resolution check
CVE-2026-49860Medium· 5.2Deno: WebSocket API sandbox bypass via missing post-DNS check
Deno: WebSocket API sandbox bypass via missing post-DNS check
CVE-2026-49402High· 8.1Deno: Command Injection via spawnSync & spawn on Windows
Deno: Command Injection via spawnSync & spawn on Windows
CVE-2026-49440High· 7.4Deno: Miller-Rabin Primality Test Allows Zero Rounds
Deno: Miller-Rabin Primality Test Allows Zero Rounds
CVE-2026-49411Medium· 6.5Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checks
CVE-2026-49406Medium· 5.5Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictions
CVE-2026-49401Medium· 5.2Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
CVE-2026-54786LowLeak in WASIp1 `fd_renumber` implementation
Leak in WASIp1 `fd_renumber` implementation
RUSTSEC-2026-0180NonePanic decoding a malformed `hstore` value allows denial of service
Panic decoding a malformed `hstore` value allows denial of service
RUSTSEC-2026-0179NoneUnbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of service
RUSTSEC-2026-0178NonePanic on a `DataRow` with fewer fields than columns allows denial of service
Panic on a `DataRow` with fewer fields than columns allows denial of service
GHSA-36hh-v3qg-5jq4HighPyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators
GHSA-chgr-c6px-7xppMediumPyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures
PyO3 has a missing `Sync` bound on `PyCFunction::new_closure` closures
CVE-2026-48107Medium· 6.5Russh: Unchecked keyboard-interactive prompt count in client auth path
Russh: Unchecked keyboard-interactive prompt count in client auth path
CVE-2026-48108Medium· 5.3Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input
Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input