Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
Select from 84 available sources using the dropdown above.
OSV Rustsec π¦ is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| rustsec-2026-0305 | Use-after-free when XML includes have duplicated entities | 2026-09-23T12:00:00Z | 2026-09-23T07:46:24Z |
| rustsec-2026-0304 | Finished streaming calls keep reading a stalled request body indefinitely | 2026-09-21T12:00:00Z | 2026-09-23T07:36:54Z |
| rustsec-2026-0303 | `stack-graphs` is archived and unmaintained | 2026-09-22T12:00:00Z | 2026-09-22T20:47:48Z |
| rustsec-2026-0302 | `stack-graphs` C API exports are safe `extern "C"` functions | 2026-09-22T12:00:00Z | 2026-09-22T20:47:48Z |
| rustsec-2026-0301 | Double free in `StackVec::retain` when a predicate or element `Drop` panics | 2026-09-22T12:00:00Z | 2026-09-22T20:47:48Z |
| rustsec-2026-0175 | `onering` 1.4.1 was removed from crates.io for malicious code | 2026-06-10T12:00:00Z | 2026-09-22T15:16:11Z |
| rustsec-2026-0300 | Use-after-free in `clear` and `retain` when an element's `Drop` panics | 2026-09-02T12:00:00Z | 2026-09-22T07:35:37Z |
| rustsec-2026-0299 | `owned-alloc` is unmaintained | 2026-09-22T12:00:00Z | 2026-09-22T07:35:37Z |
| rustsec-2026-0298 | Use-after-free when a future's `Drop` panics while the container is dropped | 2026-09-12T12:00:00Z | 2026-09-22T07:35:37Z |
| rustsec-2026-0297 | `unzip`: archive extraction is vulnerable to path traversal (zip-slip) | 2026-09-09T12:00:00Z | 2026-09-21T15:17:02Z |
| rustsec-2026-0296 | `unzip` is unmaintained | 2026-09-21T12:00:00Z | 2026-09-21T15:17:02Z |
| rustsec-2026-0295 | Memory corruption bug on `ApplyResult` type | 2026-08-12T12:00:00Z | 2026-09-21T10:08:00Z |
| rustsec-2026-0294 | Unsoundness in UTF-8 'String' trait | 2026-09-18T12:00:00Z | 2026-09-21T09:29:57Z |
| rustsec-2026-0293 | Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics | 2026-09-21T12:00:00Z | 2026-09-21T09:10:46Z |
| rustsec-2026-0292 | Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics | 2026-09-04T12:00:00Z | 2026-09-21T09:04:05Z |
| rustsec-2026-0291 | Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics | 2026-09-09T12:00:00Z | 2026-09-21T09:00:40Z |
| rustsec-2026-0104 | Reachable panic in certificate revocation list parsing | 2026-04-22T12:00:00Z | 2026-09-19T08:42:27Z |
| rustsec-2026-0099 | Name constraints were accepted for certificates asserting a wildcard name | 2026-04-14T12:00:00Z | 2026-09-19T08:42:27Z |
| rustsec-2026-0098 | Name constraints for URI names were incorrectly accepted | 2026-04-14T12:00:00Z | 2026-09-19T08:42:27Z |
| rustsec-2026-0049 | CRLs not considered authoritative by Distribution Point due to faulty matching logic | 2026-03-20T12:00:00Z | 2026-09-19T08:42:27Z |
| rustsec-2026-0290 | pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery | 2026-08-16T12:00:00Z | 2026-09-18T09:06:23Z |
| rustsec-2026-0289 | pqc_kyber is unmaintained | 2026-09-17T12:00:00Z | 2026-09-18T09:06:23Z |
| rustsec-2026-0288 | cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery | 2026-08-16T12:00:00Z | 2026-09-18T09:06:23Z |
| rustsec-2026-0287 | cosmian_kyber is unmaintained | 2026-09-17T12:00:00Z | 2026-09-18T09:06:23Z |
| rustsec-2026-0201 | Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service) | 2026-07-05T12:00:00Z | 2026-09-18T06:41:06Z |
| rustsec-2026-0200 | Unbounded page slicing from attacker-controlled CSS height causes denial of service | 2026-07-05T12:00:00Z | 2026-09-18T06:41:06Z |
| rustsec-2026-0286 | Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS | 2026-09-16T12:00:00Z | 2026-09-17T07:37:14Z |
| rustsec-2026-0285 | TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries | 2026-09-14T12:00:00Z | 2026-09-14T16:06:06Z |
| rustsec-2026-0284 | Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear` | 2026-08-26T12:00:00Z | 2026-09-14T09:48:33Z |
| rustsec-2023-0071 | Marvin Attack: potential key recovery through timing sidechannels | 2023-11-22T12:00:00Z | 2026-09-14T09:33:38Z |