nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys

CVE-2026-54541

### Impact A malicious peer acting as a state-sync source can crash a syncing node by sending a crafted `TrieChunk` who

历史摘要 · 未重新核验 · GitHub Advisory

Diesel has possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`

Diesel allows loading a SQLite database from a byte buffer, represented as `&[u8]`, at runtime via the `SqliteConnection

历史摘要 · 未重新核验 · GitHub Advisory

serde_with: KeyValueMap serialization panics on empty sequence or map entries

### Summary The public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use

历史摘要 · 未重新核验 · GitHub Advisory

`exploration` was removed from crates.io for malicious code

A method within the `exploration` crate attempted to download and execute a payload from a remote site. The malicious c

历史摘要 · 未重新核验 · GitHub Advisory

Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

CVE-2026-54136

### Summary A resource-scoped API token can read script contents outside its allowed path scope via `GET /api/w/{worksp

历史摘要 · 未重新核验 · GitHub Advisory

Rattler vulnerable to package cache path traversal via conda package build string

CVE-2026-53956

`rattler_cache` and `py-rattler` were vulnerable to package-cache path traversal when handling package metadata from con

历史摘要 · 未重新核验 · GitHub Advisory

OneRingBuf has a Use After Free Vulnerability

Affected versions of `oneringbuf` exposed the obsolete `IntoRef::into_ref` method through the public `IntoRef` trait. Fo

历史摘要 · 未重新核验 · GitHub Advisory

async-tar PAX extension-header desync enables tar entry/content smuggling

CVE-2026-53600

## Summary `async-tar` v0.6.0 mis-applies a buffered PAX `size` extension to an intermediary extension header (a GNU lo

历史摘要 · 未重新核验 · GitHub Advisory

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 ## Summary `plabayo/rama` co

历史摘要 · 未重新核验 · GitHub Advisory

ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)

CVE-2026-53531

### Summary RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\lef

历史摘要 · 未重新核验 · GitHub Advisory

ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)

CVE-2026-53530

### Summary The public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\verbéxé` (i.e. `\

历史摘要 · 未重新核验 · GitHub Advisory

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

`determine_backup_mode` in `src/uucore/src/lib/features/backup_control.rs` only checks `--backup`/`-b` and returns `Back

历史摘要 · 未重新核验 · GitHub Advisory

cut: -s ignored in -z -d '' newline-delimiter mode

CVE-2026-35381

`cut` routes `-z -d ''` through a special newline-delimiter path that ignores the `-s` only-delimited flag, emitting who

历史摘要 · 未重新核验 · GitHub Advisory

mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)

CVE-2026-35361

uutils calls `mknod` *before* setting the SELinux context (GNU uses `setfscreatecon` first, labeling atomically). If `se

历史摘要 · 未重新核验 · GitHub Advisory

mkfifo: permissions of an existing file are changed after FIFO creation fails

CVE-2026-35341

When `mkfifo()` fails (e.g. target already exists), the code shows an error but is missing a `continue;`, so it falls th

历史摘要 · 未重新核验 · GitHub Advisory

Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

CVE-2026-54496

### Summary A soundness vulnerability in the variable-base scalar multiplication gadget of `halo2_gadgets` allowed a ma

历史摘要 · 未重新核验 · GitHub Advisory

printenv: environment variables with invalid UTF-8 are silently skipped (evades inspection)

CVE-2026-35366

The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences.

历史摘要 · 未重新核验 · GitHub Advisory

uucore: safe_traversal TOCTOU protection only enabled on Linux

CVE-2026-35362

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) s

历史摘要 · 未重新核验 · GitHub Advisory

mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)

CVE-2026-35365

When moving directories across filesystems, uutils `mv` dereferences symlinks inside the tree, copying their targets as

历史摘要 · 未重新核验 · GitHub Advisory

cp: -R reads device nodes as streams, destroying device semantics

CVE-2026-35358

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device

历史摘要 · 未重新核验 · GitHub Advisory