Search Vulnerabilities

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of ser...

Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics

Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)

Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly

Prompty: Arbitrary file read via file reference expansion

nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys

Diesel has possible use after free when deserializing a SQLite database via `SqliteConnection::deserialize_readonly_database`

serde_with: KeyValueMap serialization panics on empty sequence or map entries

Wasmtime: Memory leak in C API with `externref` and `anyref` types

`exploration` was removed from crates.io for malicious code

Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Rattler vulnerable to package cache path traversal via conda package build string

OneRingBuf has a Use After Free Vulnerability

async-tar PAX extension-header desync enables tar entry/content smuggling

Malicious code in proton_pfff (crates.io)