A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request

CVE-2026-111062

### Details In `russh/src/server/encrypted.rs`, `server_read_auth_request_pk` (0.63.3, around lines 880-990): * The re

历史摘要 · 未重新核验 · GitHub Advisory

Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination

CVE-2026-58494

## Summary Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite tha

历史摘要 · 未重新核验 · GitHub Advisory

lopdf has a stack overflow via deeply nested PDF objects

`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounde

历史摘要 · 未重新核验 · GitHub Advisory

mise permits untrusted local configuration to override default shell arguments

CVE-2026-103929

## Summary Untrusted local .mise.toml [settings] can set the shell interpreter args (unix/windows default_inline / defa

历史摘要 · 未重新核验 · GitHub Advisory

uv: Path traversal on Windows through wheel extraction

CVE-2026-104843

### Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the

历史摘要 · 未重新核验 · GitHub Advisory

Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message

历史摘要 · 未重新核验 · GitHub Advisory

Praxis affected by HTTP/2 Bomb

### Summary Multiple denial-of-service vulnerabilities have been discovered in HTTP/2 server implementations. All have

历史摘要 · 未重新核验 · GitHub Advisory

Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state

CVE-2026-104855

### Impact Wasmtime's implementation of bulk-data-transfer WebAssembly instructions, such as `memory.copy`, contains a

历史摘要 · 未重新核验 · GitHub Advisory

aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers

CVE-2026-18140

### Summary Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smith

历史摘要 · 未重新核验 · GitHub Advisory

MultiTable: A Faster Hash Table at any Physical Load Factor up to and Including One

该论文提出了一种名为 multitable 的新型哈希表结构，并给出了 Rust 参考实现。作者要解决的核心问题是：现有主流工程实现（以 Rust 生态中 hashbrown 所采用的 SwissTable 为代表）在物理负载因子上受到刚性

历史摘要 · 未重新核验 · arXiv cs.CR

Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-102342

The following SVG will produce a link with a `javascript` scheme. If the user clicks this link, they will run it. ```sv

历史摘要 · 未重新核验 · GitHub Advisory

C-to-Rust Fallacy: Automatic Refactoring != Memory Security

该论文针对当前自动将 C 代码重构为 Rust 的工具开展了系统性实证研究。研究背景是 Rust 凭借内存与类型安全保证成为系统编程的热门语言，但人工把 C 迁移到 Rust 需要深入的领域知识与大量投入；因此业界出现了基于静态分析与大语言

历史摘要 · 未重新核验 · arXiv cs.CR

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

CVE-2026-63128

### Summary An unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table o

历史摘要 · 未重新核验 · GitHub Advisory

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

CVE-2026-63127

### Summary The `rmcp` library does not validate the `resource` parameter in OAuth Protected Resource metadata (RFC 9728

历史摘要 · 未重新核验 · GitHub Advisory

libp2p-quic: Remote panic via certificate expiry race during QUIC handshake

CVE-2026-61544

### Summary `libp2p-quic` can panic on an inbound QUIC handshake if a malicious peer presents a valid, short lived libp

历史摘要 · 未重新核验 · GitHub Advisory

Scaling Verification of Cryptographic Software with Aeneas, Rust, and Lean

本文提出了一套面向密码学软件的全新形式化验证方法论，其核心取向是直接验证“生产级代码”，而不是为了便于验证而专门改写代码。作者选择 Rust 作为目标语言，看重的是它在性能与系统集成方面的优势：Rust 的所有权机制使 Aeneas 工具链

历史摘要 · 未重新核验 · arXiv cs.CR

mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS

## Unbounded Remote Media Fetch and Video Frame Expansion DoS ### Summary The `POST /v1/chat/completions` endpoint in m

历史摘要 · 未重新核验 · GitHub Advisory

mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url

### Summary mistral.rs fetches any request-supplied image/audio URL with no host or IP validation, and opens arbitrary l

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

CVE-2026-63733

A `PERMISSIONS ... WHERE` clause is evaluated with permission enforcement disabled, so it can't recurse into its own che

历史摘要 · 未重新核验 · GitHub Advisory

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

CVE-2026-63735

An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different

历史摘要 · 未重新核验 · GitHub Advisory