Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 6 of 1013.
- RUSTSEC-2026-0210 `libcrux-aesgcm` Renamed to `libcrux-aes`
- RUSTSEC-2026-0209 AES-GCM did not enforce limits on AAD length
- RUSTSEC-2026-0208 Potential Panic in AVX2 SHAKE-256
- RUSTSEC-2026-0207 Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls
- RUSTSEC-2026-0206 `rustybuzz` is unmaintained
- RUSTSEC-2026-0205 `Array::insert` violates exception safety if compare function panics, leading to potential Double-Free
- RUSTSEC-2026-0204 Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid
- RUSTSEC-2026-0203 `tree-sitter-perl-next` is unmaintained
- RUSTSEC-2026-0202 `let_cxx_string!` uses uninitialized value due to exception safety violations
- RUSTSEC-2026-0199 Panic in `bcrypt::verify` on non-ASCII hash input
- RUSTSEC-2026-0198 `Report::frames_mut` allows aliased mutable references
- RUSTSEC-2026-0197 `Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices
- RUSTSEC-2026-0196 `cgmath` is unmaintained
- RUSTSEC-2026-0195 Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
- RUSTSEC-2026-0194 Quadratic run time when checking a start tag for duplicate attribute names
- RUSTSEC-2026-0192 `ttf-parser` is unmaintained
- RUSTSEC-2026-0191 `EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic
- RUSTSEC-2026-0190 Unsoundness in `Error::downcast_mut()`
- RUSTSEC-2026-0186 Unchecked pointer offset in crate `memmap2`
- RUSTSEC-2026-0184 Potential undefined behavior with Signature from a buffer-created BlameHunk
- RUSTSEC-2026-0183 Potential undefined behavior when calling Remote::list()
- RUSTSEC-2026-0175 `onering` 1.4.1 was removed from crates.io for malicious code
- RUSTSEC-2026-0174 `Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants
- RUSTSEC-2026-0173 proc-macro-error2 is unmaintained
- RUSTSEC-2026-0171 `logflux` was removed from crates.io for malicious code
- RUSTSEC-2026-0170 tide is unmaintained
- RUSTSEC-2026-0169 surf is unmaintained
- RUSTSEC-2026-0168 `pqcrypto-hqc` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0167 `pqcrypto-classicmceliece` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0166 `pqcrypto-mldsa` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0165 `pqcrypto-falcon` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0164 `pqcrypto` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0163 `pqcrypto-internals` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0162 `pqcrypto-traits` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0161 `pqcrypto-mlkem` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0160 `pqcrypto-sphincsplus` is unmaintained: upstream PQClean project being archived
- RUSTSEC-2026-0157 Several memory corruption issues via safe APIs
- RUSTSEC-2026-0156 Bad-free in `MetaCallException::new`
- RUSTSEC-2026-0150 audiopus_sys is unmaintained
- RUSTSEC-2026-0143 Double-free in `vmem` storage reachable from safe Rust
- RUSTSEC-2026-0142 Double-free in `vmem` storage reachable from safe Rust (predecessor of `oneringbuf`)
- RUSTSEC-2026-0139 Null-pointer dereference and double-free via safe APIs
- RUSTSEC-2026-0138 Unsound access to padding bytes while serializing date/time values using the Mysql backend
- RUSTSEC-2026-0135 Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend
- RUSTSEC-2026-0134 Unsound access to padding bytes while serializing date/time values using the Mysql backend
- RUSTSEC-2026-0133 Invalid pointer arithmetic in `iter()` and `iter_mut()`
- RUSTSEC-2026-0131 Double-free in `Chomp::inner()`
- RUSTSEC-2026-0130 Out-of-bounds read/write in `Index` and `IndexMut` implementations
- RUSTSEC-2026-0129 Buffer overflow in `Clusterings::from_i32_column_major_order()`
- RUSTSEC-2026-0128 Double-free and use-after-free in `Keys::next()`
- RUSTSEC-2026-0127 Integer overflow in `array::ReadWrite::new()` leading to potential memory corruption
- RUSTSEC-2026-0126 AVX2 Implementation Did Not Fully Reduce Intermediate Values
- RUSTSEC-2026-0123 Out-of-bounds read in `bytes_helper` public safe functions
- RUSTSEC-2026-0110 bare-metal is deprecated
- RUSTSEC-2026-0106 Record cache accepts AUTHORITY section NS from sibling zone via parent-pool zone-context elevation
- RUSTSEC-2026-0105 core2 is unmaintained, all versions yanked
- RUSTSEC-2026-0102 `microsoftsystem64` was removed from crates.io for malicious code
- RUSTSEC-2026-0101 `safe-agent-rs` was removed from crates.io for being affiliated with malicious code
- RUSTSEC-2026-0100 `pretty-changelog-logger` was removed from crates.io for malicious code
- RUSTSEC-2026-0084 `logprinter` was removed from crates.io for malicious code
- RUSTSEC-2026-0083 zantetsu-trainer is unmaintained
- RUSTSEC-2026-0082 zantetsu-ffi is unmaintained
- RUSTSEC-2026-0081 `logtrace` was removed from crates.io for malicious code
- RUSTSEC-2026-0078 Symbol confusion after hasher panic in `intaglio` interners
- RUSTSEC-2026-0065 `tokio-signal` is unmaintained
- RUSTSEC-2026-0064 `tokio-udp` is unmaintained
- RUSTSEC-2026-0063 `tokio-executor` is unmaintained
- RUSTSEC-2026-0062 `tokio-compat` is unmaintained
- RUSTSEC-2026-0061 `tokio-fs` is unmaintained
- RUSTSEC-2026-0060 `tokio-timer` is unmaintained
- RUSTSEC-2026-0059 `tokio-tcp` is unmaintained
- RUSTSEC-2026-0058 `tokio-io` is unmaintained
- RUSTSEC-2026-0057 `tokio-reactor` is unmaintained
- RUSTSEC-2026-0056 `tokio-codec` is unmaintained
- RUSTSEC-2026-0055 `tokio-process` is unmaintained
- RUSTSEC-2026-0054 `tokio-current-thread` is unmaintained
- RUSTSEC-2026-0053 `tokio-tls` is unmaintained
- RUSTSEC-2026-0052 `tokio-sync` is unmaintained
- RUSTSEC-2026-0051 `tokio-threadpool` is unmaintained
- RUSTSEC-2026-0050 `tokio-uds` is unmaintained
- RUSTSEC-2026-0040 `tracing-ethers` was removed from crates.io due to malicious code
- RUSTSEC-2026-0039 `chrono_anchor` was removed from crates.io due to malicious code
- RUSTSEC-2026-0028 `tracing_checks` was removed from crates.io for transitively including malicious code
- RUSTSEC-2026-0027 `tracings` was removed from crates.io for malicious code
- RUSTSEC-2026-0018 `rpc-check` was removed from crates.io for malicious code
- RUSTSEC-2026-0017 `clob-sdk` was removed from crates.io for malicious code
- RUSTSEC-2026-0016 `polymarkets-rs-clob-client` was removed from crates.io for malicious code
- RUSTSEC-2026-0015 `polymarkets-client-sdk` was removed from crates.io for malicious code
- RUSTSEC-2026-0014 `rpc-check` was removed from crates.io for malicious code
- RUSTSEC-2026-0001 Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM
- PYSEC-2026-4010 Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
- PYSEC-2026-4009 Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
- PYSEC-2026-3 Two telnyx versions published containing credential harvesting malware
- PYSEC-2026-1 A single post-release of dydx-v4-client contained obfuscated multi-stage loader
- OSV-2026-995 Heap-double-free in dxf_entities_read
- OSV-2026-987 Index-out-of-bounds in print_insn_tic6x
- OSV-2026-981 Heap-buffer-overflow in std::__1::__function::__func<grk::FileFormatJP2Decompress::FileFormatJP2Decompre
- OSV-2026-98 Heap-buffer-overflow in hostname_issubdomain
- OSV-2026-974 UNKNOWN READ in unsigned long std::__1::__tree<Ogre::VertexDeclaration*, std::__1::less<Ogre::Ve
- OSV-2026-973 Heap-buffer-overflow in bfd_getl16