Russh: Unchecked keyboard-interactive prompt count in client auth path

CVE-2026-48107

### Summary In the `russh` client keyboard-interactive authentication path, a malicious SSH server could send a `USERAUT

历史摘要 · 未重新核验 · GitHub Advisory

skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion

## Impact `skillctl` 0.1.0 and 0.1.1 contained four path-safety vulnerabilities that, in combination, allowed an attack

历史摘要 · 未重新核验 · GitHub Advisory

rattler has an entry-point path traversal in noarch:python install (arbitrary file write)

CVE-2026-47425

## Summary `EntryPoint::FromStr` in `rattler_conda_types` performs only `.trim()` on the `command` field before the lin

历史摘要 · 未重新核验 · GitHub Advisory

russh server userauth state is not reset when authentication principal changes

CVE-2026-46705

### Summary The `russh` server authentication path keeps internal userauth state across `SSH_MSG_USERAUTH_REQUEST` messa

历史摘要 · 未重新核验 · GitHub Advisory

russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

CVE-2026-46702

### Summary When SSH compression is enabled, `russh` accepted compressed packets whose on-wire size passed the normal t

历史摘要 · 未重新核验 · GitHub Advisory

uv is vulnerable to arbitrary file write through entry point names

### Impact In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (

历史摘要 · 未重新核验 · GitHub Advisory

tar has a PAX header desynchronization issue

### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (

历史摘要 · 未重新核验 · GitHub Advisory

astral-tokio-tar has a PAX Header Desynchronization issue

### Impact Versions of astral-tokio-tar prior to 0.6.2 contain a PAX header interpretation bug that allows manipulated

历史摘要 · 未重新核验 · GitHub Advisory

unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race

CVE-2026-46690

## Summary `Sender::send` in `src/lib.rs` contains an `unsafe` block in the `DISCONNECTED` arm that transmutes a **raw

历史摘要 · 未重新核验 · GitHub Advisory

Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

CVE-2026-44726

## Summary A flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in pl

历史摘要 · 未重新核验 · GitHub Advisory

Heimdall: Formally Verified Automated Migration of Legacy eBPF Programs to Rust

该论文聚焦于Linux内核扩展程序eBPF的安全迁移问题。eBPF程序被广泛用于网络、可观测性及安全策略执行，但其内核验证器仅检查低级内存安全和终止性，未强制许多高级源级属性，如初始化规则、schema一致性或错误处理。作者识别出六类源级b

历史摘要 · 未重新核验 · arXiv cs.CR

Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host

CVE-2026-46703

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and run OCI

历史摘要 · 未重新核验 · GitHub Advisory

BoxLite: Permission Bypass Allows Modification of Read-Only Files

CVE-2026-46695

#### Summary Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch O

历史摘要 · 未重新核验 · GitHub Advisory

Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory

CVE-2026-46671

### Impact A maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary

历史摘要 · 未重新核验 · GitHub Advisory

Russh: Unchecked CryptoVec allocation and growth handling is reachable

CVE-2026-46673

### Title Unchecked `CryptoVec` allocation and growth handling was reachable from local agent inputs in current `russh`

历史摘要 · 未重新核验 · GitHub Advisory

Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss

CVE-2026-46654

### Impact - **Key**: `challenger/src/multi_field_challenger.rs` | `MultiField32Challenger::duplexing` | `transcript_ma

历史摘要 · 未重新核验 · GitHub Advisory

RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM

CVE-2026-45792

RTK (Rust Token Killer) improperly trusts project-local configuration files. In versions prior to 0.32.0, RTK automatica

历史摘要 · 未重新核验 · GitHub Advisory

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

CVE-2026-45784

`CipherCtxRef::cipher_update_inplace` incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers

历史摘要 · 未重新核验 · GitHub Advisory

Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`

Diesel allows users to configure various options for PostgreSQL's `COPY FROM` and `COPY TO` statements. These configurat

历史摘要 · 未重新核验 · GitHub Advisory

Diesel: Possible unaligned data access for implementations of `SqliteAggregate`

Diesel allows to register custom aggregate SQL functions for SQLite via the `SqliteAggregate` interface. To store an in

历史摘要 · 未重新核验 · GitHub Advisory