Skip to content
Fencer Intel

All · crates.io

Newest first, late arrivals on top. Also a feed.

  1. 5.3
    CVE-2026-32322 soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction
    crates.io
  2. 8.1
    CVE-2026-32260 Command Injection via incomplete shell metacharacter blocklist in node:child_process (bypass of CVE-2026-27190 fix)
    crates.io
    EPSS 1.6% chance of exploitation in 30 days, percentile 76%
  3. 8.7
    CVE-2026-32129 Poseidon V1 variable-length input collision via implicit zero-padding
    crates.io
  4. 6.5
    GHSA-4cm8-xpfv-jv6f ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation
    crates.io
  5. 9.8
    CVE-2026-32232 ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
    crates.io
  6. 8.2
    CVE-2026-32231 ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
    crates.io
  7. —
    GHSA-725g-w329-g7qr kora-lib: Token-2022 Transfer Fee Not Deducted During Payment Verification
    crates.io
  8. —
    GHSA-x442-m7cc-hr92 kora-lib: Unrecognized Instruction Types Create Empty Stubs That Bypass Fee Payer Policy
    crates.io
  9. —
    RUSTSEC-2026-0197 `Matrix{2,3,4}::swap_columns` can trigger undefined behavior for identical indices
    crates.io
  10. —
    RUSTSEC-2026-0174 `Authorization::value` and `WwwAuthenticate::value` can violate ASCII invariants
    crates.io
  11. 5.4
    GHSA-vhj5-x93p-67jw actix-web-lab has host header poisoning in redirect middleware can generate attacker-controlled absolute redirects
    crates.io
  12. —
    RUSTSEC-2026-0039 `chrono_anchor` was removed from crates.io due to malicious code
    crates.io
  13. 5.3
    CVE-2026-31812 Quinn affected by unauthenticated remote DoS via panic in QUIC transport parameter parsing
    crates.io
  14. 9.4
    CVE-2026-30960 RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface
    crates.io
  15. —
    GHSA-pm4j-7r4q-ccg8 Soroban: Muxed address<->ScVal conversions may break after a conversion failure
    crates.io
  16. 4.0
    CVE-2026-29795 stellar-xdr: `StringM::from_str` bypasses max length validation
    crates.io
  17. 10.0
    GHSA-5wp8-q9mx-8jx8 zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
    crates.io
  18. 7.5
    GHSA-hhjv-jq77-cmvx zeptoclaw has Android device shell blocklist bypass via argument permutation
    crates.io
  19. 7.7
    CVE-2026-29178 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint
    crates.io
  20. —
    GHSA-6w86-wgwq-rgq8 neqo-qpack has iInteger overflow in qpack dynamic table indexing
    crates.io
  21. 5.4
    CVE-2026-27898 Vaultwarden: Unauthorized Access via Partial Update API on Another User’s Cipher
    crates.io
  22. 8.3
    CVE-2026-27803 Vaultwarden: Collection Management Operations Allowed Without `manage` Verification for Manager Role
    crates.io
  23. 8.3
    CVE-2026-27802 Vaultwarden: Privilege Escalation via Bulk Permission Update to Unauthorized Collections by Manager
    crates.io
  24. 5.9
    CVE-2026-27801 Vaultwarden: 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement
    crates.io
  25. —
    GHSA-xrf2-5r3p-5wgj libcrux: Panic in Signature Hint Decoding During Verification
    crates.io
  26. —
    GHSA-xhw7-jhmp-j62j `dnp3times` was removed from crates.io due to malicious code
    crates.io
  27. —
    GHSA-q29p-9pfr-j652 libcrux-sha3: Incorrect output from SHAKE squeeze functions
    crates.io
  28. —
    GHSA-pv9v-5j35-xwcr libcrux Panics During Standalone MAC Operations
    crates.io
  29. —
    GHSA-mh23-rw7f-v5pq `time-sync` was removed from crates.io due to malicious code
    crates.io
  30. —
    GHSA-cp57-fq8g-qh6v libcrux has an Incorrect Check of Signer Response Norm During Verification
    crates.io