# Vulnerabilities published in 2026 - [RUSTSEC-2026-0210](https://insights.sbomify.com/RUSTSEC-2026-0210/): `libcrux-aesgcm` Renamed to `libcrux-aes` (not scored) - [RUSTSEC-2026-0209](https://insights.sbomify.com/RUSTSEC-2026-0209/): AES-GCM did not enforce limits on AAD length (not scored) - [RUSTSEC-2026-0208](https://insights.sbomify.com/RUSTSEC-2026-0208/): Potential Panic in AVX2 SHAKE-256 (not scored) - [RUSTSEC-2026-0207](https://insights.sbomify.com/RUSTSEC-2026-0207/): Incorrect Output of Incremental Portable SHAKE API on Multiple Squeeze Calls (not scored) - [RUSTSEC-2026-0206](https://insights.sbomify.com/RUSTSEC-2026-0206/): `rustybuzz` is unmaintained (not scored) - [RUSTSEC-2026-0205](https://insights.sbomify.com/RUSTSEC-2026-0205/): `Array::insert` violates exception safety if compare function panics, leading to potential Double-Free (not scored) - [RUSTSEC-2026-0204](https://insights.sbomify.com/RUSTSEC-2026-0204/): Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid (not scored) - [RUSTSEC-2026-0203](https://insights.sbomify.com/RUSTSEC-2026-0203/): `tree-sitter-perl-next` is unmaintained (not scored) - [RUSTSEC-2026-0202](https://insights.sbomify.com/RUSTSEC-2026-0202/): `let_cxx_string!` uses uninitialized value due to exception safety violations (not scored) - [RUSTSEC-2026-0199](https://insights.sbomify.com/RUSTSEC-2026-0199/): Panic in `bcrypt::verify` on non-ASCII hash input (not scored) - [RUSTSEC-2026-0198](https://insights.sbomify.com/RUSTSEC-2026-0198/): `Report::frames_mut` allows aliased mutable references (not scored) - [RUSTSEC-2026-0197](https://insights.sbomify.com/RUSTSEC-2026-0197/): `Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices (not scored) - [RUSTSEC-2026-0196](https://insights.sbomify.com/RUSTSEC-2026-0196/): `cgmath` is unmaintained (not scored) - [RUSTSEC-2026-0195](https://insights.sbomify.com/RUSTSEC-2026-0195/): Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service (not scored) - [RUSTSEC-2026-0194](https://insights.sbomify.com/RUSTSEC-2026-0194/): Quadratic run time when checking a start tag for duplicate attribute names (not scored) - [RUSTSEC-2026-0192](https://insights.sbomify.com/RUSTSEC-2026-0192/): `ttf-parser` is unmaintained (not scored) - [RUSTSEC-2026-0191](https://insights.sbomify.com/RUSTSEC-2026-0191/): `EbpfVm::invoke_function` performs out-of-bounds pointer arithmetic (not scored) - [RUSTSEC-2026-0190](https://insights.sbomify.com/RUSTSEC-2026-0190/): Unsoundness in `Error::downcast_mut()` (not scored) - [RUSTSEC-2026-0186](https://insights.sbomify.com/RUSTSEC-2026-0186/): Unchecked pointer offset in crate `memmap2` (not scored) - [RUSTSEC-2026-0184](https://insights.sbomify.com/RUSTSEC-2026-0184/): Potential undefined behavior with Signature from a buffer-created BlameHunk (not scored) - [RUSTSEC-2026-0183](https://insights.sbomify.com/RUSTSEC-2026-0183/): Potential undefined behavior when calling Remote::list() (not scored) - [RUSTSEC-2026-0175](https://insights.sbomify.com/RUSTSEC-2026-0175/): `onering` 1.4.1 was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0174](https://insights.sbomify.com/RUSTSEC-2026-0174/): `Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants (not scored) - [RUSTSEC-2026-0173](https://insights.sbomify.com/RUSTSEC-2026-0173/): proc-macro-error2 is unmaintained (not scored) - [RUSTSEC-2026-0171](https://insights.sbomify.com/RUSTSEC-2026-0171/): `logflux` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0170](https://insights.sbomify.com/RUSTSEC-2026-0170/): tide is unmaintained (not scored) - [RUSTSEC-2026-0169](https://insights.sbomify.com/RUSTSEC-2026-0169/): surf is unmaintained (not scored) - [RUSTSEC-2026-0168](https://insights.sbomify.com/RUSTSEC-2026-0168/): `pqcrypto-hqc` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0167](https://insights.sbomify.com/RUSTSEC-2026-0167/): `pqcrypto-classicmceliece` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0166](https://insights.sbomify.com/RUSTSEC-2026-0166/): `pqcrypto-mldsa` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0165](https://insights.sbomify.com/RUSTSEC-2026-0165/): `pqcrypto-falcon` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0164](https://insights.sbomify.com/RUSTSEC-2026-0164/): `pqcrypto` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0163](https://insights.sbomify.com/RUSTSEC-2026-0163/): `pqcrypto-internals` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0162](https://insights.sbomify.com/RUSTSEC-2026-0162/): `pqcrypto-traits` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0161](https://insights.sbomify.com/RUSTSEC-2026-0161/): `pqcrypto-mlkem` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0160](https://insights.sbomify.com/RUSTSEC-2026-0160/): `pqcrypto-sphincsplus` is unmaintained: upstream PQClean project being archived (not scored) - [RUSTSEC-2026-0157](https://insights.sbomify.com/RUSTSEC-2026-0157/): Several memory corruption issues via safe APIs (not scored) - [RUSTSEC-2026-0156](https://insights.sbomify.com/RUSTSEC-2026-0156/): Bad-free in `MetaCallException::new` (not scored) - [RUSTSEC-2026-0150](https://insights.sbomify.com/RUSTSEC-2026-0150/): audiopus_sys is unmaintained (not scored) - [RUSTSEC-2026-0143](https://insights.sbomify.com/RUSTSEC-2026-0143/): Double-free in `vmem` storage reachable from safe Rust (not scored) - [RUSTSEC-2026-0142](https://insights.sbomify.com/RUSTSEC-2026-0142/): Double-free in `vmem` storage reachable from safe Rust (predecessor of `oneringbuf`) (not scored) - [RUSTSEC-2026-0139](https://insights.sbomify.com/RUSTSEC-2026-0139/): Null-pointer dereference and double-free via safe APIs (not scored) - [RUSTSEC-2026-0138](https://insights.sbomify.com/RUSTSEC-2026-0138/): Unsound access to padding bytes while serializing date/time values using the Mysql backend (not scored) - [RUSTSEC-2026-0135](https://insights.sbomify.com/RUSTSEC-2026-0135/): Unsound transmute while debug/display printing batch Insert statements in Diesel's SQLite backend (not scored) - [RUSTSEC-2026-0134](https://insights.sbomify.com/RUSTSEC-2026-0134/): Unsound access to padding bytes while serializing date/time values using the Mysql backend (not scored) - [RUSTSEC-2026-0133](https://insights.sbomify.com/RUSTSEC-2026-0133/): Invalid pointer arithmetic in `iter()` and `iter_mut()` (not scored) - [RUSTSEC-2026-0131](https://insights.sbomify.com/RUSTSEC-2026-0131/): Double-free in `Chomp::inner()` (not scored) - [RUSTSEC-2026-0130](https://insights.sbomify.com/RUSTSEC-2026-0130/): Out-of-bounds read/write in `Index` and `IndexMut` implementations (not scored) - [RUSTSEC-2026-0129](https://insights.sbomify.com/RUSTSEC-2026-0129/): Buffer overflow in `Clusterings::from_i32_column_major_order()` (not scored) - [RUSTSEC-2026-0128](https://insights.sbomify.com/RUSTSEC-2026-0128/): Double-free and use-after-free in `Keys::next()` (not scored) - [RUSTSEC-2026-0127](https://insights.sbomify.com/RUSTSEC-2026-0127/): Integer overflow in `array::ReadWrite::new()` leading to potential memory corruption (not scored) - [RUSTSEC-2026-0126](https://insights.sbomify.com/RUSTSEC-2026-0126/): AVX2 Implementation Did Not Fully Reduce Intermediate Values (not scored) - [RUSTSEC-2026-0123](https://insights.sbomify.com/RUSTSEC-2026-0123/): Out-of-bounds read in `bytes_helper` public safe functions (not scored) - [RUSTSEC-2026-0110](https://insights.sbomify.com/RUSTSEC-2026-0110/): bare-metal is deprecated (not scored) - [RUSTSEC-2026-0106](https://insights.sbomify.com/RUSTSEC-2026-0106/): Record cache accepts AUTHORITY section NS from sibling zone via parent-pool zone-context elevation (not scored) - [RUSTSEC-2026-0105](https://insights.sbomify.com/RUSTSEC-2026-0105/): core2 is unmaintained, all versions yanked (not scored) - [RUSTSEC-2026-0102](https://insights.sbomify.com/RUSTSEC-2026-0102/): `microsoftsystem64` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0101](https://insights.sbomify.com/RUSTSEC-2026-0101/): `safe-agent-rs` was removed from crates.io for being affiliated with malicious code (not scored) - [RUSTSEC-2026-0100](https://insights.sbomify.com/RUSTSEC-2026-0100/): `pretty-changelog-logger` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0084](https://insights.sbomify.com/RUSTSEC-2026-0084/): `logprinter` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0083](https://insights.sbomify.com/RUSTSEC-2026-0083/): zantetsu-trainer is unmaintained (not scored) - [RUSTSEC-2026-0082](https://insights.sbomify.com/RUSTSEC-2026-0082/): zantetsu-ffi is unmaintained (not scored) - [RUSTSEC-2026-0081](https://insights.sbomify.com/RUSTSEC-2026-0081/): `logtrace` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0078](https://insights.sbomify.com/RUSTSEC-2026-0078/): Symbol confusion after hasher panic in `intaglio` interners (not scored) - [RUSTSEC-2026-0065](https://insights.sbomify.com/RUSTSEC-2026-0065/): `tokio-signal` is unmaintained (not scored) - [RUSTSEC-2026-0064](https://insights.sbomify.com/RUSTSEC-2026-0064/): `tokio-udp` is unmaintained (not scored) - [RUSTSEC-2026-0063](https://insights.sbomify.com/RUSTSEC-2026-0063/): `tokio-executor` is unmaintained (not scored) - [RUSTSEC-2026-0062](https://insights.sbomify.com/RUSTSEC-2026-0062/): `tokio-compat` is unmaintained (not scored) - [RUSTSEC-2026-0061](https://insights.sbomify.com/RUSTSEC-2026-0061/): `tokio-fs` is unmaintained (not scored) - [RUSTSEC-2026-0060](https://insights.sbomify.com/RUSTSEC-2026-0060/): `tokio-timer` is unmaintained (not scored) - [RUSTSEC-2026-0059](https://insights.sbomify.com/RUSTSEC-2026-0059/): `tokio-tcp` is unmaintained (not scored) - [RUSTSEC-2026-0058](https://insights.sbomify.com/RUSTSEC-2026-0058/): `tokio-io` is unmaintained (not scored) - [RUSTSEC-2026-0057](https://insights.sbomify.com/RUSTSEC-2026-0057/): `tokio-reactor` is unmaintained (not scored) - [RUSTSEC-2026-0056](https://insights.sbomify.com/RUSTSEC-2026-0056/): `tokio-codec` is unmaintained (not scored) - [RUSTSEC-2026-0055](https://insights.sbomify.com/RUSTSEC-2026-0055/): `tokio-process` is unmaintained (not scored) - [RUSTSEC-2026-0054](https://insights.sbomify.com/RUSTSEC-2026-0054/): `tokio-current-thread` is unmaintained (not scored) - [RUSTSEC-2026-0053](https://insights.sbomify.com/RUSTSEC-2026-0053/): `tokio-tls` is unmaintained (not scored) - [RUSTSEC-2026-0052](https://insights.sbomify.com/RUSTSEC-2026-0052/): `tokio-sync` is unmaintained (not scored) - [RUSTSEC-2026-0051](https://insights.sbomify.com/RUSTSEC-2026-0051/): `tokio-threadpool` is unmaintained (not scored) - [RUSTSEC-2026-0050](https://insights.sbomify.com/RUSTSEC-2026-0050/): `tokio-uds` is unmaintained (not scored) - [RUSTSEC-2026-0040](https://insights.sbomify.com/RUSTSEC-2026-0040/): `tracing-ethers` was removed from crates.io due to malicious code (not scored) - [RUSTSEC-2026-0039](https://insights.sbomify.com/RUSTSEC-2026-0039/): `chrono_anchor` was removed from crates.io due to malicious code (not scored) - [RUSTSEC-2026-0028](https://insights.sbomify.com/RUSTSEC-2026-0028/): `tracing_checks` was removed from crates.io for transitively including malicious code (not scored) - [RUSTSEC-2026-0027](https://insights.sbomify.com/RUSTSEC-2026-0027/): `tracings` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0018](https://insights.sbomify.com/RUSTSEC-2026-0018/): `rpc-check` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0017](https://insights.sbomify.com/RUSTSEC-2026-0017/): `clob-sdk` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0016](https://insights.sbomify.com/RUSTSEC-2026-0016/): `polymarkets-rs-clob-client` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0015](https://insights.sbomify.com/RUSTSEC-2026-0015/): `polymarkets-client-sdk` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0014](https://insights.sbomify.com/RUSTSEC-2026-0014/): `rpc-check` was removed from crates.io for malicious code (not scored) - [RUSTSEC-2026-0001](https://insights.sbomify.com/RUSTSEC-2026-0001/): Potential Undefined Behaviors in `Arc`/`Rc` impls of `from_value` on OOM (not scored) - [PYSEC-2026-4010](https://insights.sbomify.com/PYSEC-2026-4010/): Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit (not scored) - [PYSEC-2026-4009](https://insights.sbomify.com/PYSEC-2026-4009/): Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator (not scored) - [PYSEC-2026-3](https://insights.sbomify.com/PYSEC-2026-3/): Two telnyx versions published containing credential harvesting malware (not scored) - [PYSEC-2026-1](https://insights.sbomify.com/PYSEC-2026-1/): A single post-release of dydx-v4-client contained obfuscated multi-stage loader (not scored) - [OSV-2026-995](https://insights.sbomify.com/OSV-2026-995/): Heap-double-free in dxf_entities_read (not scored) - [OSV-2026-987](https://insights.sbomify.com/OSV-2026-987/): Index-out-of-bounds in print_insn_tic6x (not scored) - [OSV-2026-981](https://insights.sbomify.com/OSV-2026-981/): Heap-buffer-overflow in std::__1::__function::__func