Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 5 of 1013.
- RUSTSEC-2026-0334 BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses
- RUSTSEC-2026-0333 Resource budgets not enforced on the typed deserialization path
- RUSTSEC-2026-0332 `WaveFormat::parse` reads past the end of a `&WAVEFORMATEX`
- RUSTSEC-2026-0331 Panic on Decoding Short Hybrid Keys
- RUSTSEC-2026-0330 Hybrid Encapsulation from Seed Panics on Short Seed
- RUSTSEC-2026-0329 Auto-Reseeding HMAC-DRBG could panic for some output lengths
- RUSTSEC-2026-0328 `decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)
- RUSTSEC-2026-0319 anymap2 is unmaintained
- RUSTSEC-2026-0318 Sending custom to-device messages may panics
- RUSTSEC-2026-0317 A 512-byte workbook can provoke a multi-gigabyte allocation and abort the process
- RUSTSEC-2026-0312 Excluded iPAddress name constraints with an all-zero mask are not applied
- RUSTSEC-2026-0311 Stack overflow on deeply nested LaTeX input
- RUSTSEC-2026-0310 Various panics, soundness and resource exhaustion issues
- RUSTSEC-2026-0309 `SinglyLinkedList::remove` dereferences a null link
- RUSTSEC-2026-0308 Use-after-free in interned values and cached function results
- RUSTSEC-2026-0307 `uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
- RUSTSEC-2026-0306 `hex_decode_unchecked` AVX2 path reads past `src`
- RUSTSEC-2026-0304 Finished streaming calls keep reading a stalled request body indefinitely
- RUSTSEC-2026-0303 `stack-graphs` is archived and unmaintained
- RUSTSEC-2026-0302 `stack-graphs` C API exports are safe `extern "C"` functions
- RUSTSEC-2026-0301 Double free in `StackVec::retain` when a predicate or element `Drop` panics
- RUSTSEC-2026-0300 Use-after-free in `clear` and `retain` when an element's `Drop` panics
- RUSTSEC-2026-0299 `owned-alloc` is unmaintained
- RUSTSEC-2026-0298 Use-after-free when a future's `Drop` panics while the container is dropped
- RUSTSEC-2026-0297 `unzip`: archive extraction is vulnerable to path traversal (zip-slip)
- RUSTSEC-2026-0296 `unzip` is unmaintained
- RUSTSEC-2026-0295 Memory corruption bug on `ApplyResult` type
- RUSTSEC-2026-0293 Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics
- RUSTSEC-2026-0292 Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics
- RUSTSEC-2026-0291 Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics
- RUSTSEC-2026-0290 pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery
- RUSTSEC-2026-0289 pqc_kyber is unmaintained
- RUSTSEC-2026-0288 cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery
- RUSTSEC-2026-0287 cosmian_kyber is unmaintained
- RUSTSEC-2026-0286 Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS
- RUSTSEC-2026-0284 Double free in `Map::into_iter` and an uninitialized `Arc` in `SharedIncin::clear`
- RUSTSEC-2026-0283 clear_on_drop is unmaintained
- RUSTSEC-2026-0282 Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics
- RUSTSEC-2026-0281 `greentic-setup` 1.3.1-dev.34027618345 was removed from crates.io due to containing malicious code
- RUSTSEC-2026-0280 `greentic-setup-dev` 1.3.34027618345 was removed from crates.io due to containing malicious code
- RUSTSEC-2026-0276 Path traversal in apimock-server's file-serving fallback
- RUSTSEC-2026-0275 Legacy `azure_core` writes the `authorization` header value to logs
- RUSTSEC-2026-0274 Double free / use-after-free in `ReadChunk::commit` when an element's `Drop` panics
- RUSTSEC-2026-0273 Stubbed cryptography without warnings
- RUSTSEC-2026-0272 Panic-safety unsoundness in `Stack::pop`, `Fifo::pop_front` and `Value::replace_stable` (use-after-free / double-free)
- RUSTSEC-2026-0271 FTP command injection via CRLF in control channel arguments
- RUSTSEC-2026-0270 `sp-sized-chunks` is unmaintained
- RUSTSEC-2026-0267 Panic-safety unsoundness in `BitVecCore::clear` (double-free / use-after-free)
- RUSTSEC-2026-0266 `internment` 0.8.7 was removed from crates.io due to a malicious dependency
- RUSTSEC-2026-0265 `proc-macro1` was removed from crates.io due to malicious code
- RUSTSEC-2026-0264 `proc-macro-en` was removed from crates.io due to malicious code
- RUSTSEC-2026-0263 `tinymember` was removed from crates.io due to affiliation with malicious code
- RUSTSEC-2026-0262 `append-only-vec` 0.1.9 was removed from crates.io due to a malicious dependency
- RUSTSEC-2026-0261 `aronenao` was removed from crates.io due to malicious code
- RUSTSEC-2026-0260 `arrayref` 0.3.10 was removed from crates.io due to a malicious dependency
- RUSTSEC-2026-0259 `arone` was removed from crates.io due to malicious code
- RUSTSEC-2026-0258 h2 unbounded empty DATA frames
- RUSTSEC-2026-0257 Unix `BROWSER` handling allows browser argument injection
- RUSTSEC-2026-0256 Several methods in `circular-buffer` drop elements before updating the buffer's start/end metadata.
- RUSTSEC-2026-0255 Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)
- RUSTSEC-2026-0254 Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)
- RUSTSEC-2026-0253 Potential use-after-free due to lack of panic safety in `LruCache::pop()`
- RUSTSEC-2026-0252 Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)
- RUSTSEC-2026-0251 sized-chunks is unmaintained
- RUSTSEC-2026-0250 im-rc is unmaintained
- RUSTSEC-2026-0249 smartstring is unmaintained
- RUSTSEC-2026-0248 im is unmaintained
- RUSTSEC-2026-0247 bitmaps is unmaintained
- RUSTSEC-2026-0246 `sevenz-rust` is unmaintained
- RUSTSEC-2026-0245 Relative/Absolute Path Traversal (CWE-23/CWE-36) in `decompress_impl` that enables an arbitrary file write.
- RUSTSEC-2026-0244 `setlocale` and `TextDomain::init` are unsound as they access environment with no synchronization
- RUSTSEC-2026-0243 `nostr-relay-pool` is unmaintained
- RUSTSEC-2026-0242 Safe ErrorRegistry APIs can cause undefined behavior
- RUSTSEC-2026-0241 `nostr-keyring` is unmaintained
- RUSTSEC-2026-0240 Ed25519 identity public keys permit universal signature forgery
- RUSTSEC-2026-0239 Streaming AEAD does not authenticate stream structure
- RUSTSEC-2026-0238 Low-level GCM ignores the operation nonce
- RUSTSEC-2026-0237 `nostr-relay-builder` is unmaintained
- RUSTSEC-2026-0236 A `BigInt` division panics, and two neighbouring operations answer wrongly in silence
- RUSTSEC-2026-0235 Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc
- RUSTSEC-2026-0234 Insufficient archive validation can cause out-of-bounds reads in archives containing hash tables
- RUSTSEC-2026-0233 Crafted archives can cause a use-after-free during deserialization
- RUSTSEC-2026-0232 Processing of unverified relay events
- RUSTSEC-2026-0231 Relay authentication challenges can exhaust memory
- RUSTSEC-2026-0230 Empty NIP-50 search filters can panic
- RUSTSEC-2026-0229 NIP-98 authorization parsing permits resource exhaustion
- RUSTSEC-2026-0228 NIP-04 parsing amplifies malformed ciphertext memory use
- RUSTSEC-2026-0227 NIP-44 v2 decryption permits resource exhaustion
- RUSTSEC-2026-0226 Wallet event parsers accept unauthenticated events
- RUSTSEC-2026-0225 Debug output exposes NIP-46 and NIP-60 credentials
- RUSTSEC-2026-0224 Verification cache poisoning allows forged Nostr events to bypass signature validation
- RUSTSEC-2026-0221 `event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`
- RUSTSEC-2026-0220 Uint shift operations: incorrect overflow flags and truncated shift amounts
- RUSTSEC-2026-0219 Remote Denial of Service via malformed NIP-04 IV
- RUSTSEC-2026-0218 `Enum` trait allows type confusion when manually implemented
- RUSTSEC-2026-0216 Remote Denial of Service via malformed NIP‑44 v2 payload
- RUSTSEC-2026-0215 smallstr is unmaintained
- RUSTSEC-2026-0214 gumdrop is unmaintained
- RUSTSEC-2026-0212 Potentially Incorrect Output of Constant-Time Swap/Select on Aarch64
- RUSTSEC-2026-0211 Non-constant time Authentication Tag Check in AES-GCM Decryption