Rust
Monthly
Stack exhaustion in the Gosub browser engine (gosub-engine through 0.1.0 and main before commit 46868b3) lets a remote, unauthenticated attacker crash any application built on the engine by getting it to render an SVG document containing an excessive number of deeply nested elements. The malicious SVG can be embedded via the SRC attribute of an IMG element on an attacker-controlled page, so exploitation requires only that a victim visit that page (UI:P) - no credentials are needed (PR:N) and the attack is network-reachable (AV:N). Impact is availability-only (a hard crash of the host application; no data exposure or code execution), no public exploit code has been identified at time of analysis, and the practical exposure is limited to the narrow set of deployments embedding the engine at those revisions, making this a genuine but low-priority issue.
Cross-tenant data access in SurrealDB before 3.3.0 allows a user holding a valid Database- or Namespace-level account to read, create, and modify records in a different tenant's namespace or database on the same instance. The flaw lies in HTTP session construction: check_auth() validates Basic credentials against the Surreal-Auth-NS/Surreal-Auth-DB headers but then builds the session from the separately supplied Surreal-NS/Surreal-DB headers without verifying that the authenticated principal may access that context, so an attacker simply points the context headers at a foreign tenant. Exploitation requires remote access to the SurrealDB HTTP interface plus an already-valid low-privilege tenant login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.6 on CVSS 4.0); no public exploit code has been identified at time of analysis, but the impact is high in any shared multi-tenant deployment and is fully resolved by upgrading to 3.3.0.
Unauthenticated content and configuration tampering in Marmite's optional built-in development server (all versions through 0.4.2) lets any network-reachable attacker create, modify, or overwrite site content and configuration by posting to the /__marmite__/content, /__marmite__/config, and /__marmite__/file/ endpoints, with no credentials or user interaction required. The same handlers pass unsanitized path parameters from handle_create_content and handle_clone_content into filesystem writes, so an attacker can traverse out of the project directory and drop or clobber files elsewhere on the host. Exploitation requires the target to be running `--serve` and reachable over the network - pre-0.4.3 the server bound to 0.0.0.0:8000 by default, and production static sites served by Nginx or Apache are unaffected; no public exploit code was identified at time of analysis, and the vendor released 0.4.3 to fix the issue (loopback-by-default binding plus a documented development-only posture).
Unauthenticated path traversal in Marmite's built-in development server (--serve) lets remote attackers read arbitrary files that the marmite process can access, by submitting percent-encoded '..' sequences that the handle_request function in src/server.rs fails to reject after decoding and path-joining. All versions through 0.4.2 are affected, and exposure is significant because the server previously defaulted to binding 0.0.0.0:8000 (all interfaces) rather than loopback, so any host running --serve on a network-facing address was reachable; the 0.4.3 fix commit narrows the default bind to 127.0.0.1 and labels the server development-only. No public exploit identified at time of analysis and the component is a development-only preview server, but the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H, 8.7) reflects a low-complexity, unauthenticated high-confidentiality read with no integrity or availability impact.
Path traversal in the Rust-based pacquet package-manager component shipped inside pnpm allows a crafted lockfile to create symlinks and directories outside the project or node_modules boundary during installation. Only pnpm npm-package versions 12.0.0-alpha.0 through 12.0.0-alpha.4 that bundle pacquet are affected, and exploitation requires the victim to explicitly run an install with --trust-lockfile or a frozen lockfile against an attacker-supplied lockfile, so the trust flag that bypasses re-resolution is the enabling condition rather than a remotely reachable flaw. Impact is integrity-focused (CVSS 7.1, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L), and no public exploit code was identified at time of analysis.
Command injection in navi through 2.24.0 allows an attacker who controls cheatsheet variable values - or file names inside a suggestion command directory - to have unescaped shell metacharacters substituted into commands that navi executes with the victim's privileges. Exploitation is local and condition-dependent: the crafted content must reach the victim (for example through a shared or poisoned cheatsheet repository) and the victim must interactively invoke the affected cheatsheet, after which arbitrary commands run at the user's own privilege level. No public exploit code was identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 4.0 score of 7.3 reflects high confidentiality, integrity, and availability impact on the victim's account once the conditions are met.
Path traversal via symlink prefix reuse in gitoxide's gix-fs crate (before 0.23.0; GHSA lists <= 0.21.0) allows a crafted repository tree to write attacker-controlled symlinks outside the worktree during forced checkout with overwrite_existing enabled, enabling code execution by overwriting known paths such as .git/hooks/post-checkout. Exploitation is local, requires user interaction to initiate checkout of an untrusted tree, and has high attack complexity tied to winning the prefix-reuse condition; no public exploit was identified at time of analysis, and no KEV or EPSS data were provided. Per the assessed CVSS:3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, unauthenticated but local access with user interaction is required.
Authorization bypass in the Rattadan Cosmowarp asset_registry smart contract (CosmWasm/Rust) lets any sender execute the privileged UpdateConfig message on deployments where the on-chain config.admin field is unset (None), because the sender-vs-admin check is nested inside an `if let Some(current_admin) = config.admin` block that is silently skipped. Impact is high on integrity and availability (VI:H/VA:H) with limited confidentiality loss (VC:L), scoring 8.4 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H; exploitation is only possible against pre-56c6147 builds of the rattadan/Cosmowarp_Contract asset_registry module running with an unset admin, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The condition is narrow but the consequence is full admin-level config control for whoever submits the transaction first.
DNS rebinding against Rojo's unauthenticated 'rojo serve' HTTP API (default bind localhost, port 34872) allows a malicious webpage to read every file in the served project, write attacker-controlled code to disk, and trigger execution of local programs through the opener::open() handler. The issue affects pre-patch builds of the rojo-rbx/rojo crate and is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High), but requires the developer to be running 'rojo serve' at the moment they visit an attacker-controlled page and requires the attacker to control DNS for the rebinding; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. Impact is high for both confidentiality and integrity (full project source disclosure and arbitrary file writes) with no availability impact; exploitation is bounded to machines actively running the dev server.
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity declarations allows unauthenticated local attackers to crash or potentially execute code in applications that use the library. Tracked as CVE-2026-96889 and reported by Red Hat, the flaw affects librsvg as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10. Exploitation requires user interaction (UI:R) because a victim must open, preview, or thumbnail a malicious SVG; the CVSS 3.1 score is 7.8. No public exploit code was identified at time of analysis, and independent assessment indicates that arbitrary code execution is unproven-only denial of service or crash is reliably reachable.
Every desktop application generated by Pake inherits two upstream template defaults that together hand native IPC functionality to untrusted web content, allowing scripts served from any HTTPS origin to invoke the application's own native commands, including download_file. The root cause is a wildcard Tauri capability ("remote": { "urls": ["https://*.*"] } in src-tauri/capabilities/default.json) paired with "withGlobalTauri": true in src-tauri/tauri.conf.json, which places window.__TAURI__.core.invoke() within reach of ordinary page JavaScript; because Tauri's access control list only validates plugin: commands and not commands registered by the application itself via generate_handler!, no permission entry is required to call them. Exploitation is unauthenticated per the assessed vector (PR:N) but requires user interaction (UI:R) - the victim must run the generated app and attacker-controlled JavaScript must execute inside it, whether directly or through third-party analytics, advertising, or a compromised CDN loaded by the wrapped site. Chained with the path traversal tracked separately as CVE-2026-82635, this escalates to arbitrary file write and persistent code execution; no public exploit identified at time of analysis, and the issue is fixed in Pake V3.17.0.
Recursive filesystem scope escalation in the Tauri dialog plugin (tauri-plugin-dialog) lets an attacker who already holds JavaScript execution inside a Tauri app's webview hijack a single, normal-looking OS file or folder picker dialog and silently widen the granted filesystem scope to the entire selected directory tree, producing persistent read/write access with no user-visible indication and no way to revoke it for the application's lifetime. The flaw affects any Tauri desktop application that uses the plugin's file or folder picker (CPE cpe:2.3:a:tauri:tauri-plugin-dialog, all versions) and is rated 7.7; it does not create the underlying injection, so exploitation requires the combination of an existing XSS/javascript-execution foothold and one user click on the dialog. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied with the source data.
Vaultwarden through 1.37.3 permits authenticated users who hold a revoked or not-yet-confirmed organization membership to retain read, write, delete, and attachment access to organization ciphers, because three cipher access-restriction queries omit a membership status filter. Exploitation requires a Vaultwarden account with a prior (revoked) or pending membership linkage to the target organization and only affects deployments that use collection- or group-based cipher sharing, so a wholly external user with no org relationship cannot exploit it; no public exploit code was identified at time of analysis, and the issue is fixed upstream via PR #7554 (upgrade past 1.37.3).
Denial of service in AWS s2n-quic 1.88.0 and earlier allows an unauthenticated remote attacker to shut down a QUIC server endpoint by sending a single crafted UDP datagram that carries a Destination Connection ID of invalid length, which the library fails to validate properly. The impact is limited to server endpoints specifically configured to send QUIC Retry packets (servers that never emit Retry packets are not affected), and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a full availability loss with no confidentiality or integrity impact and no authentication or user interaction required. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the low attack complexity and single-packet nature of the trigger make the configuration prerequisite the key scoping factor. Vendor-released patch: v1.89.0.
Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.
Improper input validation in Adobe's Content Credentials Rust SDK and its companion command-line tool lets unauthenticated remote attackers supply a crafted asset or Content Credentials manifest that slips past the SDK's validation logic, bypassing the intended security control and allowing unauthorized write/forgery of Content Credentials provenance data. The defect is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but the impact is integrity-only - confidentiality and availability are unaffected (C:N/I:H/A:N) - so exposure is bounded to applications and workflows that actually invoke the SDK or CLI to validate attacker-supplied content, particularly those relying on these credentials for media authenticity or trust decisions. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or KEV data was supplied; Adobe's advisory (APSB26-147) is the authoritative source.
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event data to create or overwrite files anywhere the Vector process has write access, affecting versions 0.10.0 up to but not including 0.57.0. Because the rendered path is opened without confinement to an intended directory, a crafted event field can supply an absolute path or '../' traversal, and Vector will even create the missing parent directories before writing. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but impact is severe (CVSS 4.0 base 9.3 / assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) and escalates to code execution when the overwritten target is a scheduled task, authorization file, or subsequently executed script. Real-world risk is configuration-gated: it requires a file sink whose path template interpolates an untrusted event field, and the damage ceiling tracks the privileges Vector runs with.
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a remote, unauthenticated attacker to abort the Vector process by sending a stream of deeply nested compressed frames over the Lumberjack/Beats protocol. Because the decoder recursively decompresses `C` frames without a depth limit, each nested layer drives the decoding thread toward stack exhaustion, and the same construction can amplify decompressed data; per the independent assessment the impact is availability only (process termination and lost log ingestion for all tenants sharing the pipeline), with no confidentiality or integrity effect, and it requires an operator to have explicitly enabled the `logstash` source on its default 0.0.0.0:5044 listener. There is no indication of active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis; the issue is remediated in Vector 0.57.0.
Unauthenticated remote attackers who can reach the Vector `logstash` source listener (default 0.0.0.0:5044) can force a multi-gigabyte memory allocation and terminate the process by sending a single minimal Lumberjack frame that merely declares a huge compressed-frame length, without transmitting those bytes. Deployments running the logstash source in Vector 0.15.0 through 0.56.x are affected; the issue is fixed in 0.57.0 by capping declared and decompressed frame sizes. Impact is availability only (crash or host OOM kill that halts log ingestion for every tenant on a shared pipeline) with no code execution or data exposure, and no public exploit code identified at time of analysis.
Missing authorization checks on Warpgate's recording-stream WebSocket let any authenticated user with an ordinary account watch live terminal input and output from other people's proxied sessions. Specifically, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs guards /@warpgate/admin/api/recordings/{uuid}/stream with session authentication only and never calls require_admin_permission for AdminPermission::RecordingsView, so an attacker who can identify an active recording's UUID receives, in real time, the keystrokes and output of proxied SSH, MySQL, and PostgreSQL sessions - including credentials and commands belonging to regular users and administrators. Warpgate versions prior to 0.25.6 are affected and the flaw is fixed in 0.25.6 (CVSS 3.1 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attack is authenticated and timing-dependent because the recording must be actively streaming, and no public exploit code was identified at time of analysis.
Stored cross-site scripting and open redirect in Warpgate's SSO endpoints (versions prior to 0.25.5) allow an unauthenticated remote attacker to inject markup and JavaScript into the authenticated Warpgate origin. The attacker stores an arbitrary 'next' parameter via /@warpgate/api/sso/providers/:name/start, which the return handler later reflects without HTML escaping; the victim must follow the crafted link and complete an SSO login before the payload executes. Successful exploitation grants access to session data and user-level APIs, escalating to administrator APIs when the victim is a Warpgate administrator, and the same unvalidated value enables an open redirect via the GET /@warpgate/api/sso/return path. The vendor rates this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting network reachability with no attacker privileges but mandatory victim interaction; no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Suricata's SMB parser allows remote, unauthenticated attackers to exhaust CPU and memory on a sensor by sustaining one-directional SMB traffic (including async-oneside flows), where force-completed transactions are retained and cleanup keeps waiting for inspection in the direction that never carries payload. Affected releases are Suricata before 7.0.17 and 8.0.0 through 8.0.5; the vendor fixed the issue in 7.0.17 and 8.0.6. Exploitation requires attacker traffic to transit a monitored network segment and to be sustained rather than a single packet, all exploitation signals indicate a genuine but moderate-priority availability issue, no public exploit has been identified at time of analysis, and EPSS is low (0.44%, 38th percentile).
Unauthenticated remote denial of service in Parseable versions prior to 3.0.0 allows any network-reachable client to crash request handling by sending a crafted x-amz-firehose-common-attributes header to the HTTP ingestion endpoint. Because the vulnerable unwrap() chain executes in src/handlers/http/middleware.rs before authentication, an attacker needs no credentials and no user interaction: supplying non-UTF-8 header bytes, malformed JSON, or a derived authorization/x-p-stream value that is not a valid HTTP header triggers a Rust panic, and repeated requests can deny service or drive the container into a restart loop. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the EPSS-style risk profile is elevated by the trivial, unauthenticated nature of the trigger; the vendor-released fix is Parseable 3.0.0.
Local privilege escalation in uutils coreutils before 0.10.0: the `install` utility applies a requested setuid/setgid mode (for example -m 4755 or -m 2755) to the destination before performing the requested ownership change, so if the underlying chown(2) call fails the file is left behind as a setuid/setgid executable owned by the privileged invoker who ran the command. Affected are uutils coreutils releases from 0.0.18 up to but not including 0.10.0 (CPE cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:*) on capability-restricted hosts where chown can actually fail, such as environments with euid != 0 or a dropped CAP_CHOWN; a local, authenticated low-privileged operator who can invoke `install` can then execute the leftover binary with elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided; the honest risk picture is a genuine but modest-priority local flaw (CVSS:4.0 7.3 AV:L/AC:H/AT:P/PR:L, our independent CVSS:3.1 assessment AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), not a mass-exploitable remote issue, because on unrestricted systems where chown succeeds the setuid bits are correctly cleared and re-applied.
hickory-resolver releases before 0.26.2 fail to propagate a 'bogus' DNSSEC proof state out of the high-level Resolver::lookup() and Resolver::lookup_ip() APIs, so records that fail DNSSEC signature validation are handed back to the caller as successful, apparently validated answers. This is an integrity-only bypass affecting unauthenticated remote attackers (CVSS:4.0 8.7 / assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) who either control the authoritative zone answering the query or sit on the network path to inject forged records with invalid RRSIGs; applications that do not compile the crate's __dnssec feature are unaffected because they never expected validation in the first place. A vendor fix is available in 0.26.2 (commit 30720f4, PR 3871), and no public exploit code or confirmed active exploitation was observed at time of analysis. This is a genuine, high-priority integrity flaw despite the absence of exploitation telemetry.
Denial of service in rustls-webpki through 0.103.12 and in 0.104.0-alpha.1 through 0.104.0-alpha.6: a crafted certificate revocation list carrying an issuingDistributionPoint extension whose onlySomeReasons BIT STRING content is exactly [0x00] triggers an integer underflow in bit_string_flags() and panics the parsing process. Unauthenticated remote attackers can reach this only where an application has explicitly opted into CRL revocation checking by passing RevocationOptions to verify_for_usage() and parses CRL bytes from a source the attacker can influence (for example an attacker-supplied or MITM'd CRL distribution point); the default rustls configuration that omits RevocationOptions is unaffected. Publicly available exploit code exists - the GHSA-82j2-j2ch-gfr8 advisory ships a complete PoC CRL that reproduces the crash - but there is no confirmation of active exploitation, and the impact is purely availability (no confidentiality or integrity effect).
Denial of service in the fulgur Rust crate affects all versions prior to 0.26.0, where a childless HTML box styled to a pathologically tall height (large `height` or `vh` values) is amplified into roughly MAX_PAGES (10,000) blank PDF pages despite producing no visible output, exhausting CPU and memory on the host and any co-tenants. The flaw is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) whenever a network-facing service passes attacker-supplied HTML/CSS into fulgur's conversion path, and the trigger payload is only a few bytes. Vendor-released patch: 0.26.0 (PR #575); no public exploit identified at time of analysis, and the crate itself performs no network I/O, so exposure depends entirely on the embedding application's deployment.
Quadratic-time attribute and namespace validation in the Rust XML parsing library roxmltree (versions through 0.21.1) lets remote, unauthenticated attackers cause denial of service by submitting an XML document that places tens of thousands of attributes or namespace declarations on a single element, driving CPU consumption far beyond what the input size would suggest. The vendor-rated CVSS of 8.7 and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that this is a pure availability issue: no confidentiality or integrity impact, no authentication or user interaction required, but exploitation requires the embedding application to parse attacker-controlled XML with roxmltree and to lack its own attribute-count, document-size, or per-request CPU/time limits. No public exploit code was identified at time of analysis, and the library's real-world exposure depends entirely on how the host application wires it in, which is why this is a genuine but bounded availability threat rather than a broadly exploitable one.
Incorrect authorization in Chroma through 1.5.9 allows any authenticated user to read, modify, and update records inside collections belonging to other tenants, simply by issuing requests under their own tenant path while naming a collection identifier that belongs to a foreign tenant. The flaw exists because the collection-resolution path never validates the tenant and database segments, so the co-tenant boundary is effectively absent - this is a real, meaningful risk but bounded by an authentication requirement (PR:L) and by the attacker's need to know or enumerate a valid foreign collection identifier. Exploitation is realistic only in multi-tenant or hosted deployments where mutually untrusted tenants share one instance; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied.
Signature forgery in Sequoia OpenPGP (sequoia-openpgp) stems from incorrect key-flag inference for legacy OpenPGP certificates that lack a key-flags subpacket, letting an unauthenticated remote attacker bypass the back-signature check and bind an arbitrary subkey to their own certificate. This compromises cryptographic integrity for any application that uses the library to verify untrusted certificates, although exploitation requires the victim to process a crafted certificate (UI:R). No public exploit code or CISA KEV entry was identified in the provided data.
Rust Yamux prior to version 0.13.10 is vulnerable to denial of service when processing specially crafted inbound stream frames that combine the SYN flag with oversized body lengths, causing the connection handler to panic due to improper state cleanup. An unauthenticated remote attacker can trigger this panic over any normal Yamux session without special privileges, crashing affected applications. No patch is currently available for this high-severity vulnerability.
Integer overflow in Rust's Yamux implementation allows unauthenticated remote attackers to crash target nodes by sending specially crafted WindowUpdate frames that trigger arithmetic overflow in stream send-window accounting. An attacker can establish a Yamux session and transmit malicious frames without authentication, causing a panic in the connection state machine and resulting in denial of service. A patch is available to address this high-severity vulnerability.
Mutation cross-site scripting in the ammonia Rust HTML sanitizer (versions prior to 3.3.2, 4.0.2, and 4.1.3) allows a remote, unauthenticated attacker to execute JavaScript in a victim's browser when the victim renders sanitized output. The flaw is config-gated: it only triggers for applications that explicitly enable the math tag, the annotation-xml tag, and at least one raw-text HTML element (such as xmp) while disallowing the encoding attribute, which is a non-default allowlist - stock ammonia configurations are not affected. ammonia's own advisory confirms the issue and vendor fixes ship in 3.3.2, 4.0.2, and 4.1.3; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis in the supplied intelligence, though a public technical writeup of the mutation technique is referenced.
Stored cross-site scripting in the Ammonia Rust HTML sanitizer affects versions 3.3.2 and earlier, 4.0.0 through 4.0.2, and 4.1.2 through 4.1.3 when a consuming application has explicitly whitelisted the SVG `animate` and `set` tags. An authenticated attacker with a content-submission path can craft an SVG whose `<set>` element sets `attributeName="href"` with a `javascript:` value, surviving sanitization because animation-target attribute names were never validated; the payload only fires if the victim clicks the resulting link (UI:R), yielding a scoped cross-site scripting impact (C:L/I:L). Ammonia's default configuration does not permit `animate` or `set`, so out-of-the-box deployments are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Russh SSH servers running versions prior to 0.62.6 that set server::Config.max_auth_attempts to a nonzero value silently fail to enforce that limit, letting an unauthenticated remote client keep sending USERAUTH_REQUEST messages on a single connection past the configured cap. The auth_attempts counter is incremented on the server::run_stream path in russh/src/server/encrypted.rs but is never compared against the configured maximum, so the intended 'too many authentication attempts' disconnect never fires, preserving unlimited online password guessing and adding backend authentication load. Practical impact is limited: the attacker must still guess valid credentials, the bug has no effect when max_auth_attempts is 0 or when external throttling (fail2ban, firewall rate limits) is used, and no public exploit code has been identified at time of analysis.
Russh, the Rust SSH client and server library, can be driven into a panic-driven connection teardown by a remote peer whenever a deployment explicitly permits mac=none in its algorithm preferences. All releases prior to 0.63.1 are affected, because negotiation validated the cipher's needs_mac() requirement only on the MAC-selection-failure branch, allowing a MAC-requiring CTR or CBC cipher such as aes256-ctr to be paired with a zero-length MAC; the attacker then sends a packet with a decrypted length of zero, shrinking the buffer read in russh/src/cipher/mod.rs and panicking the indexing at buffer.buffer[16..]. The resulting impact is availability-only (the connection task terminates) with no code execution or data exposure, requires the non-default mac=none configuration and is rated high-complexity per the assessed AV:N/AC:H/PR:N/UI:N vector (unauthenticated remote attackers per the CVSS vector), and no public exploit code has been identified at time of analysis.
Memory exhaustion in the Russh Rust SSH client/server library prior to 0.63.2 allows an authenticated remote peer to stall the rekey state machine and flood SSH_MSG_CHANNEL_OPEN requests, causing ChannelOpenReply entries to accumulate on an unbounded channel until the process is terminated (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The attack requires a valid authenticated session first and abuses the SSH rekey window: the peer sends SSH_MSG_KEXINIT but withholds the required SSH_MSG_KEX_ECDH_INIT, leaving SessionKexState::InProgress so priority_receiver in russh/src/server/session.rs is never drained while the server keeps enqueuing replies. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation remains a moderate-priority availability concern gated by how trusted the server's authenticated user population is.
The Windows Pageant client inside the pageant Rust crate (pageant/src/wmmessage.rs) trusts a peer-controlled u32 response length read from the 8192-byte Pageant shared-memory mapping, so a local process that impersonates the Pageant window can drive MemoryMap::read to allocate up to roughly 4 GiB and copy past the end of the mapped view. In practice this reliably crashes a russh-based SSH client that queries the agent via AgentClient::connect_pageant, and can conditionally expose adjacent committed memory. The issue is fixed in pageant 0.2.3 (russh v0.63.2); exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2), with no CISA KEV entry and no public exploit identified at time of analysis.
Server-side request forgery in Privoce VoceChat Server 0.5.36 and earlier lets unauthenticated remote attackers force the server to issue outbound HTTP requests to arbitrary URLs through the OpenGraph link-preview endpoint, potentially reaching internal services or cloud metadata endpoints reachable from the server's network position. Publicly available exploit code exists, and the vendor was notified early but did not respond, so no vendor-released patch has been confirmed. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) this is a real but moderate-priority SSRF - no credentials or user interaction are required, but impact is bounded to low confidentiality, integrity and availability effects and depends on whether fetch responses or errors are reflected back to the attacker (blind vs non-blind is not confirmed in the source data).
Terminal escape sequence injection in the onefetch CLI (through version 2.28.1) lets an attacker who controls a repository's project manifest metadata manipulate the victim's terminal when the victim runs onefetch against that repository. Because the tool writes manifest name and version field values directly to the terminal without neutralizing control characters, embedded ANSI/OSC sequences can rewrite window titles, hide or spoof displayed text, or trigger emulator-specific behavior; the concrete effect depends on the terminal emulator in use. There is no public exploit code identified at time of analysis and no confirmed active exploitation, CVSS is 4.8, and the assessed real-world risk is low-to-medium: the attacker must first get the victim to inspect a repository containing poisoned manifest fields, and exploitation yields display manipulation rather than code execution within onefetch itself.
Authenticated peers connected to a Windows RustDesk host running a version before 1.5.0 can bypass the one-way file transfer setting and pull files straight out of the victim's clipboard. Because the same option that is meant to prevent the local machine from serving clipboard files is the one being ignored, an attacker who already holds a valid remote session can send crafted clipboard-redirection messages (FormatDataRequest / FileContentsRequest) and, by supplying the known FileGroupDescriptorW format identifier, receive the contents of any file the user has copied. Rated only 2.3 under CVSS v4.0 (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the issue yields confidentiality impact only, requires an authenticated peer relationship plus a clipboard that already holds files, and no public exploit has been identified at time of analysis.
RustDesk before 1.5.0 on Linux and macOS fails to enforce its own file-transfer permission setting in the Cliprdr clipboard message handler, so an already-connected, authenticated peer whose file-transfer rights have been disabled can still push files onto the host's clipboard and pull back files and clipboard contents from the process-wide clipboard cache. Exploitation is network-reachable but session-gated: the attacker must first hold an authorized peer connection to the target host (CVSS 4.0 base 5.3, PR:L, C:L/I:L per the assessed vector), making this an escalation of an existing restricted session rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available from the upstream RustDesk project.
Path traversal in the littrs Rust sandboxing library (versions 0.6.1 and 0.6.2) allows the `relative` argument passed to `Sandbox::mount` in crates/littrs/src/lib.rs to escape the intended sandbox mount point and reach files outside it. The flaw is not directly reachable by anonymous internet users: it requires an application built on littrs that routes attacker-influenced input into the mount path, and the independent assessment rates the attack vector as local with low privileges required (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, C:L/I:L/A:L), even though the CNA's CVSS 4.0 vector (AV:N, CVSS 2.1) frames it as remotely performable. Publicly available exploit code exists, and the vendor was contacted but did not respond; no fixed release has been published, so risk is confined to deployments that actually feed untrusted values into `Sandbox::mount`.
Tauri applications that use the tauri-plugin-updater crate with auto-update enabled can be forced to downgrade to an older, authentically signed release, because the update manifest is fetched over TLS but is never itself signed or authenticated. An attacker who can serve a crafted manifest response - through a man-in-the-middle position on the update channel or by controlling/compromising the update server or CDN - can pair an inflated version field with the URL and minisign signature of an older release, and the plugin's only anti-rollback check compares that unsigned version field against the currently installed version. The assessment scores this as an integrity flaw (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) that is genuinely exploitable but conditional on defeating or terminating TLS or already owning the update endpoint, and it is limited to downgrading to releases that carry a valid developer signature - it does not permit signing arbitrary code. No public exploit was identified at time of analysis and the flaw is not known to be actively exploited (no CISA KEV listing); a vendor patch (updater 2.12.0) is available but the hardening option it introduces defaults to off.
Improper input validation in Adobe Content Credentials - covering both the Content Credentials Rust SDK and the Content Credentials command-line tool - lets a remote attacker bypass security checks and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page that supplies malformed input. It carries a 4.3 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), an on-the-low-end rating driven by the required victim interaction and the integrity-only, limited impact with no confidentiality or availability loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Adobe advisory cited as the reference does not state a fixed version.
Processing a maliciously crafted C2PA / Content Credentials asset through the CAI (Content Authenticity Initiative) Content Credentials Rust SDK or its companion command-line tool causes improper input validation (CWE-20) that terminates the application, resulting in an application-level denial of service. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning exploitation is unauthenticated but requires the victim to actively load attacker-supplied input - for example by opening a malformed C2PA file, visiting a crafted URL, or interacting with a compromised web page that feeds the SDK. Per the independent assessment this is a genuine but low-priority issue: only a crash is achievable (no code execution, data disclosure, or integrity modification), and no public exploit code has been identified, with the issue not listed in CISA KEV. EPSS scoring was not provided in the available intelligence.
Integer overflow in Adobe's CAI Content Credentials Rust SDK and Content Credentials command-line tool crashes applications that parse a maliciously crafted C2PA/Content Credentials asset, producing a denial-of-service condition. The flaw requires no authentication (CVSS PR:N), but exploitation is gated by user interaction (UI:R) - a victim must visit a maliciously crafted URL or interact with a compromised web page that hands the crafted asset to a vulnerable parser - and the scored impact is limited to availability loss, with no code execution or data confidentiality impact. This is a genuine but low-priority issue: no public exploit identified at time of analysis, no confirmed active exploitation, and risk is confined to applications actually built on or invoking this SDK or CLI; maintainers of downstream consumers should follow Adobe advisory apsb26-147 for fixed builds.
Improper input validation in Adobe CAI Content Credentials (the Rust SDK and the command-line tool) lets remote, unauthenticated attackers bypass integrity protections and gain unauthorized write access to Content Credentials data when a victim processes attacker-controlled content - a maliciously crafted URL or a compromised web page. Affected organizations are those embedding the Content Credentials Rust SDK or running the command-line tool in content pipelines; the impact is limited to integrity (C:N/I:H/A:N), meaning tampered provenance/manifest data rather than data theft, denial of service, or code execution. No public exploit identified at time of analysis and the issue is not reported as actively exploited; Adobe has published advisory APSB26-147, so patched builds should be applied as routine hygiene.
Improper input validation in Adobe Content Credentials - specifically the Content Credentials Rust SDK and its companion command-line tool - allows remote, unauthenticated attackers to bypass a security check and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page. The flaw is network-delivered (AV:N/AC:L/PR:N) but is gated by mandatory user interaction (UI:R), and its impact is confined to limited integrity loss (C:N/I:L/A:N) with no confidentiality or availability effect, giving it a CVSS base score of 4.3. This is a genuine but low-priority issue: no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, and it is not exploitable against a purely passive or non-interacting deployment.
Downgrade attacks against the Tauri updater plugin (tauri-plugin-updater) 2.8.0 through 2.11.x are possible because the plugin's `check` IPC command accepts an `allowDowngrades` boolean directly from frontend JavaScript, letting any code running in the app webview flip the version check from "update must be newer" to "update must be different." Where the default permission set grants allow-check to the webview, an attacker who already has an XSS foothold in the application frontend can invoke this command unauthenticated and, if they also control or compromise the update endpoint to serve an older but still validly signed release, force the app to roll back to a vulnerable version. Exploitation is conditional - it requires a pre-existing XSS, the default permission set, no custom Rust-side version comparator, and influence over the update feed - and carries a user-interaction requirement (UI:R); no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. The practical impact is an integrity and access-control failure (our assessment scores it C:N/I:H/A:N) rather than a confidentiality compromise.
Server-side request forgery in the Tauri HTTP plugin (tauri-plugin-http) before http-v2.7.0 lets any host the plugin's scope allowlist permits - a host the attacker controls or one hosting an open redirect - bounce the request onward to destinations the scope explicitly denies, including cloud metadata endpoints such as 169.254.169.254, localhost services, and internal network hosts. The plugin's reqwest client follows HTTP 3xx redirects internally and the scope allowlist was only evaluated against the frontend's original URL, so the redirect target is never re-checked; the response is then returned to the webview. Rated CVSS 5.6 (assessed AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N), it is unauthenticated but requires an attacker-influenced allowlisted origin and a frontend that actually issues the fetch; there is confirmed actively exploited (CISA KEV) status, no public exploit identified at time of analysis, and the vendor fix is opt-in.
Missing authorization in Warpgate's admin API allows an authenticated limited administrator who holds any single admin permission to extend an expiring role grant or reinstate a previously revoked one via PUT /@warpgate/admin/api/users/:id/roles/:role_id, bypassing the AdminPermission::AccessRolesAssign check that should gate role-assignment changes. Only Warpgate deployments prior to 0.28.4 on Linux that use delegated/limited admin roles are exposed, and exploitation has a hard precondition: a matching user-and-role assignment must already exist, so an attacker cannot mint a net-new grant and the impact is integrity-only (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). This is a genuine but constrained privilege-boundary flaw rather than an urgent one, and no public exploit identified at time of analysis.
Host-key trust confusion in Warpgate's browser SSH client (warpgate-web-ssh) lets a malicious or compromised SSH jump host have its host key stored against the final target's address, so a machine later presenting that key at the target address is accepted as the intended destination - permitting interception of user traffic and, when certificate authentication is used, issuance of a fresh certificate to the impersonating host. Affected are Warpgate 0.25.0 through 0.27.5 on the Web SSH path only; the native SSH proxy tracks each hop separately and is unaffected. Exploitation requires a high-barrier chain (Web SSH session by an authenticated user per PR:H, a target reached through a jump/proxy hop, Prompt or AutoAccept host-key mode with UI:R in Prompt mode, attacker possession of the jump host's private key, and a man-in-the-middle position at the target), and no public exploit code has been identified at time of analysis, with the issue not appearing in CISA KEV.
Markup injection in Warpgate's form_post SSO return interstitial (warpgate-protocol-http/src/api/sso_provider_list.rs) affects all versions prior to 0.27.6 and allows an attacker who can influence the `next` redirect parameter or IdP-derived error text to break out of the page's inline redirect script with a script-closing sequence. Because Warpgate's strict Content-Security-Policy blocks injected JavaScript and inline event handlers, the practical impact stops at content spoofing, a fabricated login form, or a meta refresh - not script execution. Reaching the sink requires an authenticated actor with SSO configuration influence (or control of an identity provider / of an email or username claim that the IdP accepts unvalidated), and the victim must actively complete the form_post SSO flow, so exploitation is high-friction; there is no public exploit identified at time of analysis and the issue is rated low severity (CVSS 3.1 base 2.4, assessed vector PR:L). The vendor released the fix in 0.27.6.
IP allow-list enforcement in Warpgate 0.23.0 through 0.27.2 is bypassed for HTTP API token authentication: when a user has allowed_ip_ranges configured, a presented X-Warpgate-Token is still resolved into a fully authorized RequestAuthorization::UserToken regardless of the source address, so a leaked, phished, or exfiltrated token can be used from a prohibited network location. Impact is limited to confidentiality of what the token-holding user could already read through the HTTP API (CVSS 4.3, C:L/I:N/A:N) - HTTP target proxying and the SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this token flow, and deployments without allowed_ip_ranges are unaffected. The issue is a remote, authenticated weakness (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis, and it is fixed in Warpgate 0.27.3.
Identity-header forwarding in the Warpgate SSH/HTTPS/MySQL bastion host prior to version 0.25.6 lets an authenticated user be authorized as a different user by proxied HTTP backends that trust the first occurrence of the reserved x-warpgate-username header. The flaw is conditional rather than a drive-by critical: it requires (1) a valid authenticated Warpgate session (PR:L) and (2) a downstream backend that both trusts Warpgate's reserved identity headers and resolves duplicate header values by taking the first, since Warpgate forwards the client-supplied value ahead of its own injected authenticated username; backends that read the last value, deduplicate, or ignore x-warpgate-* headers are unaffected. It is rated CVSS 4.9 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N), has no CISA KEV listing, and no public exploit identified at time of analysis.
Eclipse iceoryx2 versions after v0.8.0 up to v0.9.x contain a Rust soundness defect in which StaticString exposes its contents as mutable bytes via safe APIs, and the associated String::as_str() conversion does not validate UTF-8, allowing safe Rust code to construct an invalid &str and trigger undefined behavior. Exploitation requires a local authenticated attacker with low privileges and high attack complexity, and it additionally depends on an application coded in the vulnerable pattern; impact is limited to minor integrity and availability loss with no confidentiality impact, and the defect is not remotely exploitable against a default configuration. No public exploit code or active exploitation has been identified, and the vendor has released a patched version v0.10.0.
Authentication bypass in the Tencent BrowserSkill local WebSocket daemon (bsk-cli, through v0.3.0) allows any installed browser extension that presents a syntactically valid 32-character Chrome extension ID to register as a client and intercept or manipulate the page content, DOM, and screenshots returned to the AI agent. The root cause is a missing origin allowlist (CWE-346) rather than a memory-safety bug, so exploitation is limited to hosts where a hostile extension can be loaded into the browser and the daemon is running - reflected in the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N with high integrity impact (I:H) and low confidentiality/availability impact, and in the supplied CVSS 4.0 score of 6.9. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the overall risk is best characterized as a moderate, locally-scoped integrity risk rather than a widespread emergency.
CRL revocation-check bypass in rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 can cause revoked X.509 certificates to be accepted when a relying application uses the non-default UnknownStatusPolicy::Allow, because the CRL authority-matching logic compares only a certificate's first distributionPoint against each CRL's IssuingDistributionPoint and ignores any additional distributionPoints. Exploitation requires an attacker who has already compromised a trusted issuing CA (a high-privilege position, consistent with the CVSS PR:H vector) plus a target certificate that carries more than one CRL distributionPoint; the default UnknownStatusPolicy::Deny fails safe by returning Error::UnknownRevocationStatus instead of accepting the certificate. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the mid-range 5.9 CVSS 4.0 score overstates what the vendor and independent analysis both describe as a limited-impact, largely latent issue that would most plausibly let an attacker keep using an already-revoked credential.
Name-constraint bypass in rustls-webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha.1 through 0.104.0-alpha.5 allows a misissued wildcard certificate to escape permitted-subtree DNS name constraints, potentially permitting names outside the intended subtree. The flaw is reachable only after signature verification succeeds and requires a misissued wildcard certificate from a name-constrained CA, making real-world exploitation narrow and high-complexity (assessed CVSS 3.1 base 2.1, PR:N, AC:H). No public exploit identified at time of analysis; vendor-released patches are available in 0.103.12 and 0.104.0-alpha.6.
rustls-webpki 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 accept X.509 name constraints that apply to URI names instead of enforcing them, so a misissued certificate that violates such a constraint is treated as valid. Impact is deliberately narrow: URI name constraints are only reachable after successful signature verification, the library provides no API for asserting URI names, and exploitation therefore requires a certificate authority in the trusted path to have misissued a certificate. There is no public exploit identified at time of analysis, no CISA KEV listing, and our assessment treats this as a low-priority, defense-in-depth hardening fix consistent with the vendor's CVSS 4.0 score of 2.1 rather than an urgent vulnerability.
Credential leakage in the rmcp Rust SDK (the official Rust SDK for the Model Context Protocol) prior to 2.1.0 allows an attacker who controls or compromises an MCP endpoint to harvest API keys and tokens from victim clients. StreamableHttpClientTransport builds its default reqwest HTTP client with automatic redirect following and replays caller-supplied StreamableHttpClientTransportConfig.custom_headers on cross-origin 307/308 redirects without marking them sensitive, so secrets such as x-api-key headers are forwarded to the redirect target where the attacker can capture and reuse them. The issue is not actively exploited per available intelligence, no public exploit code was identified at time of analysis, and exploitation is condition-gated: it requires a client that (a) runs a pre-2.1.0 version, (b) places secrets in custom_headers rather than the standard Authorization path, and (c) talks to a malicious or compromised MCP server, which is why the assessed vector carries high attack complexity and limits impact to confidentiality (CVSS 6.8, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, CWE-200). A vendor patch is available in rmcp 2.1.0.
Unbounded memory growth in the AG-UI Rust client's SSE frame parser (crates/ag-ui-client/src/sse.rs, shipped in the ag-ui 1.0 community SDK) lets a malicious, compromised, or machine-in-the-middle SSE server exhaust the memory of the consuming client process by streaming a frame it never terminates with a blank-line delimiter. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but the outcome is a denial of service confined to the client process, matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L rather than the higher CVSS 4.0 score of 6.9. Exploitation requires the Rust client to open an SSE connection to an endpoint that the attacker controls, has compromised, or can intercept; a correctly behaving server never triggers the flaw, so this is a client-side parsing weakness rather than a remotely reachable listening service.
Credential leakage in Cargo's sparse index registry URL normalization affects all Cargo releases from 1.68 through 1.96. The flaw caused Cargo to incorrectly apply git-registry canonicalization rules - specifically, stripping `.git` suffixes and lowercasing GitHub paths - to sparse index protocol URLs (prefixed with `sparse+`). This allowed two distinct sparse registry URLs that differed only by a `.git` suffix to resolve to the same canonical identifier, meaning credentials configured for one registry could be transmitted to a different, attacker-controlled registry on the same domain. No public exploit identified at time of analysis; EPSS is 0.04% (12th percentile), consistent with the vendor-assessed low severity and SSVC exploitation status of none.
PAX/ustar header desynchronization in astral-tokio-tar 0.5.5 and earlier lets unauthenticated attackers smuggle hidden archive entries that the parser misreads as top-level files, potentially producing attacker-controlled filesystem writes when the library extracts an untrusted tarball - the most consequential downstream consumer being the uv Python package installer. Per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (8.1), no authentication is needed but a user or automated ingestion pipeline must actually process the crafted archive (UI:R), and the vendor states there are no workarounds, so upgrading to 0.5.6 is the only reliable fix. Risk signals are moderately aligned: EPSS is low at 0.70% (52nd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, though the disclosure is accompanied by public technical writeups ("Tarmageddon") and a demonstration repository.
Denial of service in the Rust crate alloy-dyn-abi (part of the alloy-rs/core Ethereum library stack) allows an attacker who can supply malformed EIP-712 typed data to crash the calling process. Because the library panics inside eip712_signing_hash() instead of returning an error, any wallet, signing service, or RPC frontend that hashes attacker-influenced TypedData in versions before 0.8.26 or in the 1.x line before 1.4.1 can be repeatedly knocked offline; unauthenticated remote triggering is possible per the CVSS vector (AV:N/AC:L/PR:N/UI:N), though reachability depends on the application actually deserializing and hashing untrusted TypedData. Exploitation is bounded and not an emergency: EPSS is only 0.45% (37th percentile), there is no CISA KEV confirmation, and no public exploit code identified at time of analysis - the primary fix is simply upgrading.
Privilege escalation vulnerability in the Rust 'users' crate that incorrectly includes the root group in access control lists when a user or process has fewer than 1024 groups. An authenticated local attacker with low privileges can exploit this flaw to gain unauthorized access to resources restricted to the root group, achieving privilege escalation. The vulnerability requires local access and existing user privileges but has high impact on confidentiality and integrity.
Rust is a programming language. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PHP, Rust, Haskell process library, yt-dlp) that wrap the API without compensating for its quirks. Remote attackers can smuggle additional commands through arguments passed to child processes when applications spawn batch files or otherwise rely on CreateProcess's implicit cmd.exe handling. Publicly available exploit code exists and EPSS of 7.09% (92nd percentile) signals elevated, though not confirmed in-the-wild, exploitation interest; this CVE is not listed in CISA KEV.
Rust is a programming language. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cargo downloads a Rust project’s dependencies and compiles the project. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Stack exhaustion in the Gosub browser engine (gosub-engine through 0.1.0 and main before commit 46868b3) lets a remote, unauthenticated attacker crash any application built on the engine by getting it to render an SVG document containing an excessive number of deeply nested elements. The malicious SVG can be embedded via the SRC attribute of an IMG element on an attacker-controlled page, so exploitation requires only that a victim visit that page (UI:P) - no credentials are needed (PR:N) and the attack is network-reachable (AV:N). Impact is availability-only (a hard crash of the host application; no data exposure or code execution), no public exploit code has been identified at time of analysis, and the practical exposure is limited to the narrow set of deployments embedding the engine at those revisions, making this a genuine but low-priority issue.
Cross-tenant data access in SurrealDB before 3.3.0 allows a user holding a valid Database- or Namespace-level account to read, create, and modify records in a different tenant's namespace or database on the same instance. The flaw lies in HTTP session construction: check_auth() validates Basic credentials against the Surreal-Auth-NS/Surreal-Auth-DB headers but then builds the session from the separately supplied Surreal-NS/Surreal-DB headers without verifying that the authenticated principal may access that context, so an attacker simply points the context headers at a foreign tenant. Exploitation requires remote access to the SurrealDB HTTP interface plus an already-valid low-privilege tenant login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.6 on CVSS 4.0); no public exploit code has been identified at time of analysis, but the impact is high in any shared multi-tenant deployment and is fully resolved by upgrading to 3.3.0.
Unauthenticated content and configuration tampering in Marmite's optional built-in development server (all versions through 0.4.2) lets any network-reachable attacker create, modify, or overwrite site content and configuration by posting to the /__marmite__/content, /__marmite__/config, and /__marmite__/file/ endpoints, with no credentials or user interaction required. The same handlers pass unsanitized path parameters from handle_create_content and handle_clone_content into filesystem writes, so an attacker can traverse out of the project directory and drop or clobber files elsewhere on the host. Exploitation requires the target to be running `--serve` and reachable over the network - pre-0.4.3 the server bound to 0.0.0.0:8000 by default, and production static sites served by Nginx or Apache are unaffected; no public exploit code was identified at time of analysis, and the vendor released 0.4.3 to fix the issue (loopback-by-default binding plus a documented development-only posture).
Unauthenticated path traversal in Marmite's built-in development server (--serve) lets remote attackers read arbitrary files that the marmite process can access, by submitting percent-encoded '..' sequences that the handle_request function in src/server.rs fails to reject after decoding and path-joining. All versions through 0.4.2 are affected, and exposure is significant because the server previously defaulted to binding 0.0.0.0:8000 (all interfaces) rather than loopback, so any host running --serve on a network-facing address was reachable; the 0.4.3 fix commit narrows the default bind to 127.0.0.1 and labels the server development-only. No public exploit identified at time of analysis and the component is a development-only preview server, but the CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:H, 8.7) reflects a low-complexity, unauthenticated high-confidentiality read with no integrity or availability impact.
Path traversal in the Rust-based pacquet package-manager component shipped inside pnpm allows a crafted lockfile to create symlinks and directories outside the project or node_modules boundary during installation. Only pnpm npm-package versions 12.0.0-alpha.0 through 12.0.0-alpha.4 that bundle pacquet are affected, and exploitation requires the victim to explicitly run an install with --trust-lockfile or a frozen lockfile against an attacker-supplied lockfile, so the trust flag that bypasses re-resolution is the enabling condition rather than a remotely reachable flaw. Impact is integrity-focused (CVSS 7.1, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L), and no public exploit code was identified at time of analysis.
Command injection in navi through 2.24.0 allows an attacker who controls cheatsheet variable values - or file names inside a suggestion command directory - to have unescaped shell metacharacters substituted into commands that navi executes with the victim's privileges. Exploitation is local and condition-dependent: the crafted content must reach the victim (for example through a shared or poisoned cheatsheet repository) and the victim must interactively invoke the affected cheatsheet, after which arbitrary commands run at the user's own privilege level. No public exploit code was identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 4.0 score of 7.3 reflects high confidentiality, integrity, and availability impact on the victim's account once the conditions are met.
Path traversal via symlink prefix reuse in gitoxide's gix-fs crate (before 0.23.0; GHSA lists <= 0.21.0) allows a crafted repository tree to write attacker-controlled symlinks outside the worktree during forced checkout with overwrite_existing enabled, enabling code execution by overwriting known paths such as .git/hooks/post-checkout. Exploitation is local, requires user interaction to initiate checkout of an untrusted tree, and has high attack complexity tied to winning the prefix-reuse condition; no public exploit was identified at time of analysis, and no KEV or EPSS data were provided. Per the assessed CVSS:3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, unauthenticated but local access with user interaction is required.
Authorization bypass in the Rattadan Cosmowarp asset_registry smart contract (CosmWasm/Rust) lets any sender execute the privileged UpdateConfig message on deployments where the on-chain config.admin field is unset (None), because the sender-vs-admin check is nested inside an `if let Some(current_admin) = config.admin` block that is silently skipped. Impact is high on integrity and availability (VI:H/VA:H) with limited confidentiality loss (VC:L), scoring 8.4 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H; exploitation is only possible against pre-56c6147 builds of the rattadan/Cosmowarp_Contract asset_registry module running with an unset admin, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The condition is narrow but the consequence is full admin-level config control for whoever submits the transaction first.
DNS rebinding against Rojo's unauthenticated 'rojo serve' HTTP API (default bind localhost, port 34872) allows a malicious webpage to read every file in the served project, write attacker-controlled code to disk, and trigger execution of local programs through the opener::open() handler. The issue affects pre-patch builds of the rojo-rbx/rojo crate and is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 8.1 High), but requires the developer to be running 'rojo serve' at the moment they visit an attacker-controlled page and requires the attacker to control DNS for the rebinding; no public exploit code was identified at time of analysis and the flaw is not in CISA KEV. Impact is high for both confidentiality and integrity (full project source disclosure and arbitrary file writes) with no availability impact; exploitation is bounded to machines actively running the dev server.
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity declarations allows unauthenticated local attackers to crash or potentially execute code in applications that use the library. Tracked as CVE-2026-96889 and reported by Red Hat, the flaw affects librsvg as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10. Exploitation requires user interaction (UI:R) because a victim must open, preview, or thumbnail a malicious SVG; the CVSS 3.1 score is 7.8. No public exploit code was identified at time of analysis, and independent assessment indicates that arbitrary code execution is unproven-only denial of service or crash is reliably reachable.
Every desktop application generated by Pake inherits two upstream template defaults that together hand native IPC functionality to untrusted web content, allowing scripts served from any HTTPS origin to invoke the application's own native commands, including download_file. The root cause is a wildcard Tauri capability ("remote": { "urls": ["https://*.*"] } in src-tauri/capabilities/default.json) paired with "withGlobalTauri": true in src-tauri/tauri.conf.json, which places window.__TAURI__.core.invoke() within reach of ordinary page JavaScript; because Tauri's access control list only validates plugin: commands and not commands registered by the application itself via generate_handler!, no permission entry is required to call them. Exploitation is unauthenticated per the assessed vector (PR:N) but requires user interaction (UI:R) - the victim must run the generated app and attacker-controlled JavaScript must execute inside it, whether directly or through third-party analytics, advertising, or a compromised CDN loaded by the wrapped site. Chained with the path traversal tracked separately as CVE-2026-82635, this escalates to arbitrary file write and persistent code execution; no public exploit identified at time of analysis, and the issue is fixed in Pake V3.17.0.
Recursive filesystem scope escalation in the Tauri dialog plugin (tauri-plugin-dialog) lets an attacker who already holds JavaScript execution inside a Tauri app's webview hijack a single, normal-looking OS file or folder picker dialog and silently widen the granted filesystem scope to the entire selected directory tree, producing persistent read/write access with no user-visible indication and no way to revoke it for the application's lifetime. The flaw affects any Tauri desktop application that uses the plugin's file or folder picker (CPE cpe:2.3:a:tauri:tauri-plugin-dialog, all versions) and is rated 7.7; it does not create the underlying injection, so exploitation requires the combination of an existing XSS/javascript-execution foothold and one user click on the dialog. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied with the source data.
Vaultwarden through 1.37.3 permits authenticated users who hold a revoked or not-yet-confirmed organization membership to retain read, write, delete, and attachment access to organization ciphers, because three cipher access-restriction queries omit a membership status filter. Exploitation requires a Vaultwarden account with a prior (revoked) or pending membership linkage to the target organization and only affects deployments that use collection- or group-based cipher sharing, so a wholly external user with no org relationship cannot exploit it; no public exploit code was identified at time of analysis, and the issue is fixed upstream via PR #7554 (upgrade past 1.37.3).
Denial of service in AWS s2n-quic 1.88.0 and earlier allows an unauthenticated remote attacker to shut down a QUIC server endpoint by sending a single crafted UDP datagram that carries a Destination Connection ID of invalid length, which the library fails to validate properly. The impact is limited to server endpoints specifically configured to send QUIC Retry packets (servers that never emit Retry packets are not affected), and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a full availability loss with no confidentiality or integrity impact and no authentication or user interaction required. There is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but the low attack complexity and single-packet nature of the trigger make the configuration prerequisite the key scoping factor. Vendor-released patch: v1.89.0.
Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.
Improper input validation in Adobe's Content Credentials Rust SDK and its companion command-line tool lets unauthenticated remote attackers supply a crafted asset or Content Credentials manifest that slips past the SDK's validation logic, bypassing the intended security control and allowing unauthorized write/forgery of Content Credentials provenance data. The defect is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but the impact is integrity-only - confidentiality and availability are unaffected (C:N/I:H/A:N) - so exposure is bounded to applications and workflows that actually invoke the SDK or CLI to validate attacker-supplied content, particularly those relying on these credentials for media authenticity or trust decisions. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or KEV data was supplied; Adobe's advisory (APSB26-147) is the authoritative source.
Unconfined template path resolution in the Vector observability pipeline's file sink allows attacker-influenced event data to create or overwrite files anywhere the Vector process has write access, affecting versions 0.10.0 up to but not including 0.57.0. Because the rendered path is opened without confinement to an intended directory, a crafted event field can supply an absolute path or '../' traversal, and Vector will even create the missing parent directories before writing. No public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but impact is severe (CVSS 4.0 base 9.3 / assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) and escalates to code execution when the overwritten target is a scheduled task, authorization file, or subsequently executed script. Real-world risk is configuration-gated: it requires a file sink whose path template interpolates an untrusted event field, and the damage ceiling tracks the privileges Vector runs with.
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a remote, unauthenticated attacker to abort the Vector process by sending a stream of deeply nested compressed frames over the Lumberjack/Beats protocol. Because the decoder recursively decompresses `C` frames without a depth limit, each nested layer drives the decoding thread toward stack exhaustion, and the same construction can amplify decompressed data; per the independent assessment the impact is availability only (process termination and lost log ingestion for all tenants sharing the pipeline), with no confidentiality or integrity effect, and it requires an operator to have explicitly enabled the `logstash` source on its default 0.0.0.0:5044 listener. There is no indication of active exploitation (no CISA KEV entry) and no public exploit code identified at time of analysis; the issue is remediated in Vector 0.57.0.
Unauthenticated remote attackers who can reach the Vector `logstash` source listener (default 0.0.0.0:5044) can force a multi-gigabyte memory allocation and terminate the process by sending a single minimal Lumberjack frame that merely declares a huge compressed-frame length, without transmitting those bytes. Deployments running the logstash source in Vector 0.15.0 through 0.56.x are affected; the issue is fixed in 0.57.0 by capping declared and decompressed frame sizes. Impact is availability only (crash or host OOM kill that halts log ingestion for every tenant on a shared pipeline) with no code execution or data exposure, and no public exploit code identified at time of analysis.
Missing authorization checks on Warpgate's recording-stream WebSocket let any authenticated user with an ordinary account watch live terminal input and output from other people's proxied sessions. Specifically, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs guards /@warpgate/admin/api/recordings/{uuid}/stream with session authentication only and never calls require_admin_permission for AdminPermission::RecordingsView, so an attacker who can identify an active recording's UUID receives, in real time, the keystrokes and output of proxied SSH, MySQL, and PostgreSQL sessions - including credentials and commands belonging to regular users and administrators. Warpgate versions prior to 0.25.6 are affected and the flaw is fixed in 0.25.6 (CVSS 3.1 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attack is authenticated and timing-dependent because the recording must be actively streaming, and no public exploit code was identified at time of analysis.
Stored cross-site scripting and open redirect in Warpgate's SSO endpoints (versions prior to 0.25.5) allow an unauthenticated remote attacker to inject markup and JavaScript into the authenticated Warpgate origin. The attacker stores an arbitrary 'next' parameter via /@warpgate/api/sso/providers/:name/start, which the return handler later reflects without HTML escaping; the victim must follow the crafted link and complete an SSO login before the payload executes. Successful exploitation grants access to session data and user-level APIs, escalating to administrator APIs when the victim is a Warpgate administrator, and the same unvalidated value enables an open redirect via the GET /@warpgate/api/sso/return path. The vendor rates this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), reflecting network reachability with no attacker privileges but mandatory victim interaction; no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Suricata's SMB parser allows remote, unauthenticated attackers to exhaust CPU and memory on a sensor by sustaining one-directional SMB traffic (including async-oneside flows), where force-completed transactions are retained and cleanup keeps waiting for inspection in the direction that never carries payload. Affected releases are Suricata before 7.0.17 and 8.0.0 through 8.0.5; the vendor fixed the issue in 7.0.17 and 8.0.6. Exploitation requires attacker traffic to transit a monitored network segment and to be sustained rather than a single packet, all exploitation signals indicate a genuine but moderate-priority availability issue, no public exploit has been identified at time of analysis, and EPSS is low (0.44%, 38th percentile).
Unauthenticated remote denial of service in Parseable versions prior to 3.0.0 allows any network-reachable client to crash request handling by sending a crafted x-amz-firehose-common-attributes header to the HTTP ingestion endpoint. Because the vulnerable unwrap() chain executes in src/handlers/http/middleware.rs before authentication, an attacker needs no credentials and no user interaction: supplying non-UTF-8 header bytes, malformed JSON, or a derived authorization/x-p-stream value that is not a valid HTTP header triggers a Rust panic, and repeated requests can deny service or drive the container into a restart loop. No public exploit code and no confirmed active exploitation were identified at time of analysis, though the EPSS-style risk profile is elevated by the trivial, unauthenticated nature of the trigger; the vendor-released fix is Parseable 3.0.0.
Local privilege escalation in uutils coreutils before 0.10.0: the `install` utility applies a requested setuid/setgid mode (for example -m 4755 or -m 2755) to the destination before performing the requested ownership change, so if the underlying chown(2) call fails the file is left behind as a setuid/setgid executable owned by the privileged invoker who ran the command. Affected are uutils coreutils releases from 0.0.18 up to but not including 0.10.0 (CPE cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:*) on capability-restricted hosts where chown can actually fail, such as environments with euid != 0 or a dropped CAP_CHOWN; a local, authenticated low-privileged operator who can invoke `install` can then execute the leftover binary with elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided; the honest risk picture is a genuine but modest-priority local flaw (CVSS:4.0 7.3 AV:L/AC:H/AT:P/PR:L, our independent CVSS:3.1 assessment AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), not a mass-exploitable remote issue, because on unrestricted systems where chown succeeds the setuid bits are correctly cleared and re-applied.
hickory-resolver releases before 0.26.2 fail to propagate a 'bogus' DNSSEC proof state out of the high-level Resolver::lookup() and Resolver::lookup_ip() APIs, so records that fail DNSSEC signature validation are handed back to the caller as successful, apparently validated answers. This is an integrity-only bypass affecting unauthenticated remote attackers (CVSS:4.0 8.7 / assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) who either control the authoritative zone answering the query or sit on the network path to inject forged records with invalid RRSIGs; applications that do not compile the crate's __dnssec feature are unaffected because they never expected validation in the first place. A vendor fix is available in 0.26.2 (commit 30720f4, PR 3871), and no public exploit code or confirmed active exploitation was observed at time of analysis. This is a genuine, high-priority integrity flaw despite the absence of exploitation telemetry.
Denial of service in rustls-webpki through 0.103.12 and in 0.104.0-alpha.1 through 0.104.0-alpha.6: a crafted certificate revocation list carrying an issuingDistributionPoint extension whose onlySomeReasons BIT STRING content is exactly [0x00] triggers an integer underflow in bit_string_flags() and panics the parsing process. Unauthenticated remote attackers can reach this only where an application has explicitly opted into CRL revocation checking by passing RevocationOptions to verify_for_usage() and parses CRL bytes from a source the attacker can influence (for example an attacker-supplied or MITM'd CRL distribution point); the default rustls configuration that omits RevocationOptions is unaffected. Publicly available exploit code exists - the GHSA-82j2-j2ch-gfr8 advisory ships a complete PoC CRL that reproduces the crash - but there is no confirmation of active exploitation, and the impact is purely availability (no confidentiality or integrity effect).
Denial of service in the fulgur Rust crate affects all versions prior to 0.26.0, where a childless HTML box styled to a pathologically tall height (large `height` or `vh` values) is amplified into roughly MAX_PAGES (10,000) blank PDF pages despite producing no visible output, exhausting CPU and memory on the host and any co-tenants. The flaw is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) whenever a network-facing service passes attacker-supplied HTML/CSS into fulgur's conversion path, and the trigger payload is only a few bytes. Vendor-released patch: 0.26.0 (PR #575); no public exploit identified at time of analysis, and the crate itself performs no network I/O, so exposure depends entirely on the embedding application's deployment.
Quadratic-time attribute and namespace validation in the Rust XML parsing library roxmltree (versions through 0.21.1) lets remote, unauthenticated attackers cause denial of service by submitting an XML document that places tens of thousands of attributes or namespace declarations on a single element, driving CPU consumption far beyond what the input size would suggest. The vendor-rated CVSS of 8.7 and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that this is a pure availability issue: no confidentiality or integrity impact, no authentication or user interaction required, but exploitation requires the embedding application to parse attacker-controlled XML with roxmltree and to lack its own attribute-count, document-size, or per-request CPU/time limits. No public exploit code was identified at time of analysis, and the library's real-world exposure depends entirely on how the host application wires it in, which is why this is a genuine but bounded availability threat rather than a broadly exploitable one.
Incorrect authorization in Chroma through 1.5.9 allows any authenticated user to read, modify, and update records inside collections belonging to other tenants, simply by issuing requests under their own tenant path while naming a collection identifier that belongs to a foreign tenant. The flaw exists because the collection-resolution path never validates the tenant and database segments, so the co-tenant boundary is effectively absent - this is a real, meaningful risk but bounded by an authentication requirement (PR:L) and by the attacker's need to know or enumerate a valid foreign collection identifier. Exploitation is realistic only in multi-tenant or hosted deployments where mutually untrusted tenants share one instance; no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS score was supplied.
Signature forgery in Sequoia OpenPGP (sequoia-openpgp) stems from incorrect key-flag inference for legacy OpenPGP certificates that lack a key-flags subpacket, letting an unauthenticated remote attacker bypass the back-signature check and bind an arbitrary subkey to their own certificate. This compromises cryptographic integrity for any application that uses the library to verify untrusted certificates, although exploitation requires the victim to process a crafted certificate (UI:R). No public exploit code or CISA KEV entry was identified in the provided data.
Rust Yamux prior to version 0.13.10 is vulnerable to denial of service when processing specially crafted inbound stream frames that combine the SYN flag with oversized body lengths, causing the connection handler to panic due to improper state cleanup. An unauthenticated remote attacker can trigger this panic over any normal Yamux session without special privileges, crashing affected applications. No patch is currently available for this high-severity vulnerability.
Integer overflow in Rust's Yamux implementation allows unauthenticated remote attackers to crash target nodes by sending specially crafted WindowUpdate frames that trigger arithmetic overflow in stream send-window accounting. An attacker can establish a Yamux session and transmit malicious frames without authentication, causing a panic in the connection state machine and resulting in denial of service. A patch is available to address this high-severity vulnerability.
Mutation cross-site scripting in the ammonia Rust HTML sanitizer (versions prior to 3.3.2, 4.0.2, and 4.1.3) allows a remote, unauthenticated attacker to execute JavaScript in a victim's browser when the victim renders sanitized output. The flaw is config-gated: it only triggers for applications that explicitly enable the math tag, the annotation-xml tag, and at least one raw-text HTML element (such as xmp) while disallowing the encoding attribute, which is a non-default allowlist - stock ammonia configurations are not affected. ammonia's own advisory confirms the issue and vendor fixes ship in 3.3.2, 4.0.2, and 4.1.3; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis in the supplied intelligence, though a public technical writeup of the mutation technique is referenced.
Stored cross-site scripting in the Ammonia Rust HTML sanitizer affects versions 3.3.2 and earlier, 4.0.0 through 4.0.2, and 4.1.2 through 4.1.3 when a consuming application has explicitly whitelisted the SVG `animate` and `set` tags. An authenticated attacker with a content-submission path can craft an SVG whose `<set>` element sets `attributeName="href"` with a `javascript:` value, surviving sanitization because animation-target attribute names were never validated; the payload only fires if the victim clicks the resulting link (UI:R), yielding a scoped cross-site scripting impact (C:L/I:L). Ammonia's default configuration does not permit `animate` or `set`, so out-of-the-box deployments are unaffected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Russh SSH servers running versions prior to 0.62.6 that set server::Config.max_auth_attempts to a nonzero value silently fail to enforce that limit, letting an unauthenticated remote client keep sending USERAUTH_REQUEST messages on a single connection past the configured cap. The auth_attempts counter is incremented on the server::run_stream path in russh/src/server/encrypted.rs but is never compared against the configured maximum, so the intended 'too many authentication attempts' disconnect never fires, preserving unlimited online password guessing and adding backend authentication load. Practical impact is limited: the attacker must still guess valid credentials, the bug has no effect when max_auth_attempts is 0 or when external throttling (fail2ban, firewall rate limits) is used, and no public exploit code has been identified at time of analysis.
Russh, the Rust SSH client and server library, can be driven into a panic-driven connection teardown by a remote peer whenever a deployment explicitly permits mac=none in its algorithm preferences. All releases prior to 0.63.1 are affected, because negotiation validated the cipher's needs_mac() requirement only on the MAC-selection-failure branch, allowing a MAC-requiring CTR or CBC cipher such as aes256-ctr to be paired with a zero-length MAC; the attacker then sends a packet with a decrypted length of zero, shrinking the buffer read in russh/src/cipher/mod.rs and panicking the indexing at buffer.buffer[16..]. The resulting impact is availability-only (the connection task terminates) with no code execution or data exposure, requires the non-default mac=none configuration and is rated high-complexity per the assessed AV:N/AC:H/PR:N/UI:N vector (unauthenticated remote attackers per the CVSS vector), and no public exploit code has been identified at time of analysis.
Memory exhaustion in the Russh Rust SSH client/server library prior to 0.63.2 allows an authenticated remote peer to stall the rekey state machine and flood SSH_MSG_CHANNEL_OPEN requests, causing ChannelOpenReply entries to accumulate on an unbounded channel until the process is terminated (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The attack requires a valid authenticated session first and abuses the SSH rekey window: the peer sends SSH_MSG_KEXINIT but withholds the required SSH_MSG_KEX_ECDH_INIT, leaving SessionKexState::InProgress so priority_receiver in russh/src/server/session.rs is never drained while the server keeps enqueuing replies. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation remains a moderate-priority availability concern gated by how trusted the server's authenticated user population is.
The Windows Pageant client inside the pageant Rust crate (pageant/src/wmmessage.rs) trusts a peer-controlled u32 response length read from the 8192-byte Pageant shared-memory mapping, so a local process that impersonates the Pageant window can drive MemoryMap::read to allocate up to roughly 4 GiB and copy past the end of the mapped view. In practice this reliably crashes a russh-based SSH client that queries the agent via AgentClient::connect_pageant, and can conditionally expose adjacent committed memory. The issue is fixed in pageant 0.2.3 (russh v0.63.2); exploitation is local-only (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2), with no CISA KEV entry and no public exploit identified at time of analysis.
Server-side request forgery in Privoce VoceChat Server 0.5.36 and earlier lets unauthenticated remote attackers force the server to issue outbound HTTP requests to arbitrary URLs through the OpenGraph link-preview endpoint, potentially reaching internal services or cloud metadata endpoints reachable from the server's network position. Publicly available exploit code exists, and the vendor was notified early but did not respond, so no vendor-released patch has been confirmed. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) this is a real but moderate-priority SSRF - no credentials or user interaction are required, but impact is bounded to low confidentiality, integrity and availability effects and depends on whether fetch responses or errors are reflected back to the attacker (blind vs non-blind is not confirmed in the source data).
Terminal escape sequence injection in the onefetch CLI (through version 2.28.1) lets an attacker who controls a repository's project manifest metadata manipulate the victim's terminal when the victim runs onefetch against that repository. Because the tool writes manifest name and version field values directly to the terminal without neutralizing control characters, embedded ANSI/OSC sequences can rewrite window titles, hide or spoof displayed text, or trigger emulator-specific behavior; the concrete effect depends on the terminal emulator in use. There is no public exploit code identified at time of analysis and no confirmed active exploitation, CVSS is 4.8, and the assessed real-world risk is low-to-medium: the attacker must first get the victim to inspect a repository containing poisoned manifest fields, and exploitation yields display manipulation rather than code execution within onefetch itself.
Authenticated peers connected to a Windows RustDesk host running a version before 1.5.0 can bypass the one-way file transfer setting and pull files straight out of the victim's clipboard. Because the same option that is meant to prevent the local machine from serving clipboard files is the one being ignored, an attacker who already holds a valid remote session can send crafted clipboard-redirection messages (FormatDataRequest / FileContentsRequest) and, by supplying the known FileGroupDescriptorW format identifier, receive the contents of any file the user has copied. Rated only 2.3 under CVSS v4.0 (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), the issue yields confidentiality impact only, requires an authenticated peer relationship plus a clipboard that already holds files, and no public exploit has been identified at time of analysis.
RustDesk before 1.5.0 on Linux and macOS fails to enforce its own file-transfer permission setting in the Cliprdr clipboard message handler, so an already-connected, authenticated peer whose file-transfer rights have been disabled can still push files onto the host's clipboard and pull back files and clipboard contents from the process-wide clipboard cache. Exploitation is network-reachable but session-gated: the attacker must first hold an authorized peer connection to the target host (CVSS 4.0 base 5.3, PR:L, C:L/I:L per the assessed vector), making this an escalation of an existing restricted session rather than an unauthenticated entry point. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; a vendor patch is available from the upstream RustDesk project.
Path traversal in the littrs Rust sandboxing library (versions 0.6.1 and 0.6.2) allows the `relative` argument passed to `Sandbox::mount` in crates/littrs/src/lib.rs to escape the intended sandbox mount point and reach files outside it. The flaw is not directly reachable by anonymous internet users: it requires an application built on littrs that routes attacker-influenced input into the mount path, and the independent assessment rates the attack vector as local with low privileges required (CVSS:3.1 AV:L/AC:L/PR:L/UI:N, C:L/I:L/A:L), even though the CNA's CVSS 4.0 vector (AV:N, CVSS 2.1) frames it as remotely performable. Publicly available exploit code exists, and the vendor was contacted but did not respond; no fixed release has been published, so risk is confined to deployments that actually feed untrusted values into `Sandbox::mount`.
Tauri applications that use the tauri-plugin-updater crate with auto-update enabled can be forced to downgrade to an older, authentically signed release, because the update manifest is fetched over TLS but is never itself signed or authenticated. An attacker who can serve a crafted manifest response - through a man-in-the-middle position on the update channel or by controlling/compromising the update server or CDN - can pair an inflated version field with the URL and minisign signature of an older release, and the plugin's only anti-rollback check compares that unsigned version field against the currently installed version. The assessment scores this as an integrity flaw (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) that is genuinely exploitable but conditional on defeating or terminating TLS or already owning the update endpoint, and it is limited to downgrading to releases that carry a valid developer signature - it does not permit signing arbitrary code. No public exploit was identified at time of analysis and the flaw is not known to be actively exploited (no CISA KEV listing); a vendor patch (updater 2.12.0) is available but the hardening option it introduces defaults to off.
Improper input validation in Adobe Content Credentials - covering both the Content Credentials Rust SDK and the Content Credentials command-line tool - lets a remote attacker bypass security checks and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page that supplies malformed input. It carries a 4.3 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), an on-the-low-end rating driven by the required victim interaction and the integrity-only, limited impact with no confidentiality or availability loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Adobe advisory cited as the reference does not state a fixed version.
Processing a maliciously crafted C2PA / Content Credentials asset through the CAI (Content Authenticity Initiative) Content Credentials Rust SDK or its companion command-line tool causes improper input validation (CWE-20) that terminates the application, resulting in an application-level denial of service. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning exploitation is unauthenticated but requires the victim to actively load attacker-supplied input - for example by opening a malformed C2PA file, visiting a crafted URL, or interacting with a compromised web page that feeds the SDK. Per the independent assessment this is a genuine but low-priority issue: only a crash is achievable (no code execution, data disclosure, or integrity modification), and no public exploit code has been identified, with the issue not listed in CISA KEV. EPSS scoring was not provided in the available intelligence.
Integer overflow in Adobe's CAI Content Credentials Rust SDK and Content Credentials command-line tool crashes applications that parse a maliciously crafted C2PA/Content Credentials asset, producing a denial-of-service condition. The flaw requires no authentication (CVSS PR:N), but exploitation is gated by user interaction (UI:R) - a victim must visit a maliciously crafted URL or interact with a compromised web page that hands the crafted asset to a vulnerable parser - and the scored impact is limited to availability loss, with no code execution or data confidentiality impact. This is a genuine but low-priority issue: no public exploit identified at time of analysis, no confirmed active exploitation, and risk is confined to applications actually built on or invoking this SDK or CLI; maintainers of downstream consumers should follow Adobe advisory apsb26-147 for fixed builds.
Improper input validation in Adobe CAI Content Credentials (the Rust SDK and the command-line tool) lets remote, unauthenticated attackers bypass integrity protections and gain unauthorized write access to Content Credentials data when a victim processes attacker-controlled content - a maliciously crafted URL or a compromised web page. Affected organizations are those embedding the Content Credentials Rust SDK or running the command-line tool in content pipelines; the impact is limited to integrity (C:N/I:H/A:N), meaning tampered provenance/manifest data rather than data theft, denial of service, or code execution. No public exploit identified at time of analysis and the issue is not reported as actively exploited; Adobe has published advisory APSB26-147, so patched builds should be applied as routine hygiene.
Improper input validation in Adobe Content Credentials - specifically the Content Credentials Rust SDK and its companion command-line tool - allows remote, unauthenticated attackers to bypass a security check and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page. The flaw is network-delivered (AV:N/AC:L/PR:N) but is gated by mandatory user interaction (UI:R), and its impact is confined to limited integrity loss (C:N/I:L/A:N) with no confidentiality or availability effect, giving it a CVSS base score of 4.3. This is a genuine but low-priority issue: no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, and it is not exploitable against a purely passive or non-interacting deployment.
Downgrade attacks against the Tauri updater plugin (tauri-plugin-updater) 2.8.0 through 2.11.x are possible because the plugin's `check` IPC command accepts an `allowDowngrades` boolean directly from frontend JavaScript, letting any code running in the app webview flip the version check from "update must be newer" to "update must be different." Where the default permission set grants allow-check to the webview, an attacker who already has an XSS foothold in the application frontend can invoke this command unauthenticated and, if they also control or compromise the update endpoint to serve an older but still validly signed release, force the app to roll back to a vulnerable version. Exploitation is conditional - it requires a pre-existing XSS, the default permission set, no custom Rust-side version comparator, and influence over the update feed - and carries a user-interaction requirement (UI:R); no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. The practical impact is an integrity and access-control failure (our assessment scores it C:N/I:H/A:N) rather than a confidentiality compromise.
Server-side request forgery in the Tauri HTTP plugin (tauri-plugin-http) before http-v2.7.0 lets any host the plugin's scope allowlist permits - a host the attacker controls or one hosting an open redirect - bounce the request onward to destinations the scope explicitly denies, including cloud metadata endpoints such as 169.254.169.254, localhost services, and internal network hosts. The plugin's reqwest client follows HTTP 3xx redirects internally and the scope allowlist was only evaluated against the frontend's original URL, so the redirect target is never re-checked; the response is then returned to the webview. Rated CVSS 5.6 (assessed AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N), it is unauthenticated but requires an attacker-influenced allowlisted origin and a frontend that actually issues the fetch; there is confirmed actively exploited (CISA KEV) status, no public exploit identified at time of analysis, and the vendor fix is opt-in.
Missing authorization in Warpgate's admin API allows an authenticated limited administrator who holds any single admin permission to extend an expiring role grant or reinstate a previously revoked one via PUT /@warpgate/admin/api/users/:id/roles/:role_id, bypassing the AdminPermission::AccessRolesAssign check that should gate role-assignment changes. Only Warpgate deployments prior to 0.28.4 on Linux that use delegated/limited admin roles are exposed, and exploitation has a hard precondition: a matching user-and-role assignment must already exist, so an attacker cannot mint a net-new grant and the impact is integrity-only (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). This is a genuine but constrained privilege-boundary flaw rather than an urgent one, and no public exploit identified at time of analysis.
Host-key trust confusion in Warpgate's browser SSH client (warpgate-web-ssh) lets a malicious or compromised SSH jump host have its host key stored against the final target's address, so a machine later presenting that key at the target address is accepted as the intended destination - permitting interception of user traffic and, when certificate authentication is used, issuance of a fresh certificate to the impersonating host. Affected are Warpgate 0.25.0 through 0.27.5 on the Web SSH path only; the native SSH proxy tracks each hop separately and is unaffected. Exploitation requires a high-barrier chain (Web SSH session by an authenticated user per PR:H, a target reached through a jump/proxy hop, Prompt or AutoAccept host-key mode with UI:R in Prompt mode, attacker possession of the jump host's private key, and a man-in-the-middle position at the target), and no public exploit code has been identified at time of analysis, with the issue not appearing in CISA KEV.
Markup injection in Warpgate's form_post SSO return interstitial (warpgate-protocol-http/src/api/sso_provider_list.rs) affects all versions prior to 0.27.6 and allows an attacker who can influence the `next` redirect parameter or IdP-derived error text to break out of the page's inline redirect script with a script-closing sequence. Because Warpgate's strict Content-Security-Policy blocks injected JavaScript and inline event handlers, the practical impact stops at content spoofing, a fabricated login form, or a meta refresh - not script execution. Reaching the sink requires an authenticated actor with SSO configuration influence (or control of an identity provider / of an email or username claim that the IdP accepts unvalidated), and the victim must actively complete the form_post SSO flow, so exploitation is high-friction; there is no public exploit identified at time of analysis and the issue is rated low severity (CVSS 3.1 base 2.4, assessed vector PR:L). The vendor released the fix in 0.27.6.
IP allow-list enforcement in Warpgate 0.23.0 through 0.27.2 is bypassed for HTTP API token authentication: when a user has allowed_ip_ranges configured, a presented X-Warpgate-Token is still resolved into a fully authorized RequestAuthorization::UserToken regardless of the source address, so a leaked, phished, or exfiltrated token can be used from a prohibited network location. Impact is limited to confidentiality of what the token-holding user could already read through the HTTP API (CVSS 4.3, C:L/I:N/A:N) - HTTP target proxying and the SSH, MySQL, PostgreSQL, RDP, VNC, and Kubernetes paths do not accept this token flow, and deployments without allowed_ip_ranges are unaffected. The issue is a remote, authenticated weakness (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis, and it is fixed in Warpgate 0.27.3.
Identity-header forwarding in the Warpgate SSH/HTTPS/MySQL bastion host prior to version 0.25.6 lets an authenticated user be authorized as a different user by proxied HTTP backends that trust the first occurrence of the reserved x-warpgate-username header. The flaw is conditional rather than a drive-by critical: it requires (1) a valid authenticated Warpgate session (PR:L) and (2) a downstream backend that both trusts Warpgate's reserved identity headers and resolves duplicate header values by taking the first, since Warpgate forwards the client-supplied value ahead of its own injected authenticated username; backends that read the last value, deduplicate, or ignore x-warpgate-* headers are unaffected. It is rated CVSS 4.9 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N), has no CISA KEV listing, and no public exploit identified at time of analysis.
Eclipse iceoryx2 versions after v0.8.0 up to v0.9.x contain a Rust soundness defect in which StaticString exposes its contents as mutable bytes via safe APIs, and the associated String::as_str() conversion does not validate UTF-8, allowing safe Rust code to construct an invalid &str and trigger undefined behavior. Exploitation requires a local authenticated attacker with low privileges and high attack complexity, and it additionally depends on an application coded in the vulnerable pattern; impact is limited to minor integrity and availability loss with no confidentiality impact, and the defect is not remotely exploitable against a default configuration. No public exploit code or active exploitation has been identified, and the vendor has released a patched version v0.10.0.
Authentication bypass in the Tencent BrowserSkill local WebSocket daemon (bsk-cli, through v0.3.0) allows any installed browser extension that presents a syntactically valid 32-character Chrome extension ID to register as a client and intercept or manipulate the page content, DOM, and screenshots returned to the AI agent. The root cause is a missing origin allowlist (CWE-346) rather than a memory-safety bug, so exploitation is limited to hosts where a hostile extension can be loaded into the browser and the daemon is running - reflected in the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N with high integrity impact (I:H) and low confidentiality/availability impact, and in the supplied CVSS 4.0 score of 6.9. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the overall risk is best characterized as a moderate, locally-scoped integrity risk rather than a widespread emergency.
CRL revocation-check bypass in rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 can cause revoked X.509 certificates to be accepted when a relying application uses the non-default UnknownStatusPolicy::Allow, because the CRL authority-matching logic compares only a certificate's first distributionPoint against each CRL's IssuingDistributionPoint and ignores any additional distributionPoints. Exploitation requires an attacker who has already compromised a trusted issuing CA (a high-privilege position, consistent with the CVSS PR:H vector) plus a target certificate that carries more than one CRL distributionPoint; the default UnknownStatusPolicy::Deny fails safe by returning Error::UnknownRevocationStatus instead of accepting the certificate. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the mid-range 5.9 CVSS 4.0 score overstates what the vendor and independent analysis both describe as a limited-impact, largely latent issue that would most plausibly let an attacker keep using an already-revoked credential.
Name-constraint bypass in rustls-webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha.1 through 0.104.0-alpha.5 allows a misissued wildcard certificate to escape permitted-subtree DNS name constraints, potentially permitting names outside the intended subtree. The flaw is reachable only after signature verification succeeds and requires a misissued wildcard certificate from a name-constrained CA, making real-world exploitation narrow and high-complexity (assessed CVSS 3.1 base 2.1, PR:N, AC:H). No public exploit identified at time of analysis; vendor-released patches are available in 0.103.12 and 0.104.0-alpha.6.
rustls-webpki 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 accept X.509 name constraints that apply to URI names instead of enforcing them, so a misissued certificate that violates such a constraint is treated as valid. Impact is deliberately narrow: URI name constraints are only reachable after successful signature verification, the library provides no API for asserting URI names, and exploitation therefore requires a certificate authority in the trusted path to have misissued a certificate. There is no public exploit identified at time of analysis, no CISA KEV listing, and our assessment treats this as a low-priority, defense-in-depth hardening fix consistent with the vendor's CVSS 4.0 score of 2.1 rather than an urgent vulnerability.
Credential leakage in the rmcp Rust SDK (the official Rust SDK for the Model Context Protocol) prior to 2.1.0 allows an attacker who controls or compromises an MCP endpoint to harvest API keys and tokens from victim clients. StreamableHttpClientTransport builds its default reqwest HTTP client with automatic redirect following and replays caller-supplied StreamableHttpClientTransportConfig.custom_headers on cross-origin 307/308 redirects without marking them sensitive, so secrets such as x-api-key headers are forwarded to the redirect target where the attacker can capture and reuse them. The issue is not actively exploited per available intelligence, no public exploit code was identified at time of analysis, and exploitation is condition-gated: it requires a client that (a) runs a pre-2.1.0 version, (b) places secrets in custom_headers rather than the standard Authorization path, and (c) talks to a malicious or compromised MCP server, which is why the assessed vector carries high attack complexity and limits impact to confidentiality (CVSS 6.8, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, CWE-200). A vendor patch is available in rmcp 2.1.0.
Unbounded memory growth in the AG-UI Rust client's SSE frame parser (crates/ag-ui-client/src/sse.rs, shipped in the ag-ui 1.0 community SDK) lets a malicious, compromised, or machine-in-the-middle SSE server exhaust the memory of the consuming client process by streaming a frame it never terminates with a blank-line delimiter. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but the outcome is a denial of service confined to the client process, matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L rather than the higher CVSS 4.0 score of 6.9. Exploitation requires the Rust client to open an SSE connection to an endpoint that the attacker controls, has compromised, or can intercept; a correctly behaving server never triggers the flaw, so this is a client-side parsing weakness rather than a remotely reachable listening service.
Credential leakage in Cargo's sparse index registry URL normalization affects all Cargo releases from 1.68 through 1.96. The flaw caused Cargo to incorrectly apply git-registry canonicalization rules - specifically, stripping `.git` suffixes and lowercasing GitHub paths - to sparse index protocol URLs (prefixed with `sparse+`). This allowed two distinct sparse registry URLs that differed only by a `.git` suffix to resolve to the same canonical identifier, meaning credentials configured for one registry could be transmitted to a different, attacker-controlled registry on the same domain. No public exploit identified at time of analysis; EPSS is 0.04% (12th percentile), consistent with the vendor-assessed low severity and SSVC exploitation status of none.
PAX/ustar header desynchronization in astral-tokio-tar 0.5.5 and earlier lets unauthenticated attackers smuggle hidden archive entries that the parser misreads as top-level files, potentially producing attacker-controlled filesystem writes when the library extracts an untrusted tarball - the most consequential downstream consumer being the uv Python package installer. Per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (8.1), no authentication is needed but a user or automated ingestion pipeline must actually process the crafted archive (UI:R), and the vendor states there are no workarounds, so upgrading to 0.5.6 is the only reliable fix. Risk signals are moderately aligned: EPSS is low at 0.70% (52nd percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, though the disclosure is accompanied by public technical writeups ("Tarmageddon") and a demonstration repository.
Denial of service in the Rust crate alloy-dyn-abi (part of the alloy-rs/core Ethereum library stack) allows an attacker who can supply malformed EIP-712 typed data to crash the calling process. Because the library panics inside eip712_signing_hash() instead of returning an error, any wallet, signing service, or RPC frontend that hashes attacker-influenced TypedData in versions before 0.8.26 or in the 1.x line before 1.4.1 can be repeatedly knocked offline; unauthenticated remote triggering is possible per the CVSS vector (AV:N/AC:L/PR:N/UI:N), though reachability depends on the application actually deserializing and hashing untrusted TypedData. Exploitation is bounded and not an emergency: EPSS is only 0.45% (37th percentile), there is no CISA KEV confirmation, and no public exploit code identified at time of analysis - the primary fix is simply upgrading.
Privilege escalation vulnerability in the Rust 'users' crate that incorrectly includes the root group in access control lists when a user or process has fewer than 1024 groups. An authenticated local attacker with low privileges can exploit this flaw to gain unauthorized access to resources restricted to the root group, achieving privilege escalation. The vulnerability requires local access and existing user privileges but has high impact on confidentiality and integrity.
Rust is a programming language. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PHP, Rust, Haskell process library, yt-dlp) that wrap the API without compensating for its quirks. Remote attackers can smuggle additional commands through arguments passed to child processes when applications spawn batch files or otherwise rely on CreateProcess's implicit cmd.exe handling. Publicly available exploit code exists and EPSS of 7.09% (92nd percentile) signals elevated, though not confirmed in-the-wild, exploitation interest; this CVE is not listed in CISA KEV.
Rust is a programming language. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cargo downloads a Rust project’s dependencies and compiles the project. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once for the same index (under certain conditions) when next_back() and next() are. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.51.0, the Zip implementation calls __iterator_get_unchecked() for the same index more than once when nested. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, can violate Rust's safety guarantees and cause memory unsafety. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contains a CWE-680: Integer Overflow to Buffer Overflow vulnerability in standard. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Rust Programming Language Rust standard library version Commit bfa0e1f58acf1c28d500c34ed258f09ae021893e and later; stable release 1.3.0 and later contains a Buffer Overflow vulnerability in. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.