Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

442 results · page 4 of 9

Dec 26, 2021An issue was discovered in the actix-web crate before 0.7.15 for Rust.CVE-2018-25025 · Other software · Actix · reported by MITRECritical 9.8
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
Product
Actix-web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the actix-web crate before 0.7.15 for Rust.CVE-2018-25024 · Other software · Actix · reported by MITRECritical 9.8
An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
Product
Actix-web
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the smallvec crate before 0.6.13 for Rust.CVE-2018-25023 · Other software · Servo · reported by MITREHigh 7.5
An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.
Product
Smallvec
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com raw.githubusercontent.com
Dec 26, 2021An issue was discovered in the lru crate before 0.7.1 for Rust.CVE-2021-45720 · Other software · LRU Project · reported by MITREHigh 7.5
An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free, as demonstrated by an access after a pop operation.
Product
LRU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust.CVE-2021-45719 · Other software · Rusqlite Project · reported by MITREHigh 7.5
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. update_hook has a use-after-free.
Product
Rusqlite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust.CVE-2021-45718 · Other software · Rusqlite Project · reported by MITREHigh 7.5
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free.
Product
Rusqlite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust.CVE-2021-45717 · Other software · Rusqlite Project · reported by MITREHigh 7.5
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free.
Product
Rusqlite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust.CVE-2021-45716 · Other software · Rusqlite Project · reported by MITREHigh 7.5
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free.
Product
Rusqlite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust.CVE-2021-45715 · Other software · Rusqlite Project · reported by MITREHigh 7.5
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_window_function has a use-after-free.
Product
Rusqlite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust.CVE-2021-45714 · Other software · Rusqlite Project · reported by MITREHigh 7.5
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_aggregate_function has a use-after-free.
Product
Rusqlite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust.CVE-2021-45713 · Other software · Rusqlite Project · reported by MITREHigh 7.5
An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free.
Product
Rusqlite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Dec 26, 2021An issue was discovered in the rust-embed crate before 6.3.0 for Rust.CVE-2021-45712 · Other software · Rust-embed Project · reported by MITREHigh 7.5
An issue was discovered in the rust-embed crate before 6.3.0 for Rust. A ../ directory traversal can sometimes occur in debug mode.
Product
Rust-embed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Nov 15, 2021An issue was discovered in the fruity crate through 0.2.0 for Rust.CVE-2021-43620 · Other software · Fruity Project · reported by MITREHigh 7.5
An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first '\0' byte, which might not be the end of the string.
Product
Fruity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 18, 2021The evm crate is a pure Rust implementation of Ethereum Virtual Machine.CVE-2021-41153 · Other software · rust-blockchain · reported by GitHubHigh 8.7
The evm crate is a pure Rust implementation of Ethereum Virtual Machine. In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check. This is a **high** severity security advisory if you use `evm` crate for Ethereum mainnet. In this case, you should update your library dependency immediately to on or after `0.31.0`. This is a **low** severity security advisory if you use `evm` crate in Frontier or in a standalone blockchain, because there's no security exploit possible with this advisory. It is **not** recommended to update to on or after `0.31.0` until all the normal chain upgrade preparations have been done. If you use Frontier or other `pallet-evm` based Substrate blockchain, please ensure to update your `spec_version` before updating this. For other blockchains, please make sure to follow a hard-fork process before you update this.
Product
evm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 27, 2021ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\GaminCVE-2021-40981 · Network & remote access · Asus · reported by MITREHigh 7.3
ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\GamingCenterLib directory.
Product
Armoury Crate Lite Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record aptw.tf aptw.tf
Aug 10, 2021An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust.CVE-2021-38512 · Other software · Actix · reported by MITREHigh 7.5
An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential disclosure.
Product
Actix-http
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org raw.githubusercontent.com
Aug 10, 2021An issue was discovered in the tar crate before 0.4.36 for Rust.CVE-2021-38511 · Other software · TAR Project · reported by MITREHigh 7.5
An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.
Product
TAR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the better-macro crate through 2021-07-22 for Rust.CVE-2021-38196 · Other software · Better-macro Project · reported by MITRECritical 9.8
An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros, and otherwise has no legitimate purpose.
Product
Better-macro
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust.CVE-2021-38195 · Other software · Parity · reported by MITRECritical 9.8
An issue was discovered in the libsecp256k1 crate before 0.5.0 for Rust. It can verify an invalid signature because it allows the R or S parameter to be larger than the curve order, aka an overflow.
Product
Libsecp256k1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust.CVE-2021-38194 · Other software · Arcworks · reported by MITRECritical 9.8
An issue was discovered in the ark-r1cs-std crate before 0.3.1 for Rust. It does not enforce any constraints in the FieldVar::mul_by_inverse method. Thus, a prover can produce a proof that is unsound but is nonetheless verified.
Product
Ark-r1cs-std
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the ammonia crate before 3.1.0 for Rust.CVE-2021-38193 · Other software · Ammonia Project · reported by MITREMedium 6.1
An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870.
Product
Ammonia
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the prost-types crate before 0.8.0 for Rust.CVE-2021-38192 · Other software · Prost Project · reported by MITREHigh 7.5
An issue was discovered in the prost-types crate before 0.8.0 for Rust. An overflow can occur during conversion from Timestamp to SystemTime.
Product
Prost
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the tokio crate before 1.8.1 for Rust.CVE-2021-38191 · Other software · Tokio · reported by MITREMedium 5.9
An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.
Product
Tokio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the nalgebra crate before 0.27.1 for Rust.CVE-2021-38190 · Other software · Dimforge · reported by MITRECritical 9.8
An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count.
Product
Nalgebra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the lettre crate before 0.9.6 for Rust.CVE-2021-38189 · Other software · Lettre · reported by MITRECritical 9.8
An issue was discovered in the lettre crate before 0.9.6 for Rust. In an e-mail message body, an attacker can place a . character after two <CR><LF> sequences and then inject arbitrary SMTP commands.
Product
Lettre
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the iced-x86 crate through 1.10.3 for Rust.CVE-2021-38188 · Other software · Iced-x86 Project · reported by MITRECritical 9.8
An issue was discovered in the iced-x86 crate through 1.10.3 for Rust. In Decoder::new(), slice.get_unchecked(slice.length()) is used unsafely.
Product
Iced-x86
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the anymap crate through 0.12.1 for Rust.CVE-2021-38187 · Other software · Anymap Project · reported by MITRECritical 9.8
An issue was discovered in the anymap crate through 0.12.1 for Rust. It violates soundness via conversion of a *u8 to a *u64.
Product
Anymap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the comrak crate before 0.10.1 for Rust.CVE-2021-38186 · Other software · Comrak Project · reported by MITREMedium 6.1
An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities.
Product
Comrak
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the max7301 crate before 0.2.0 for Rust.CVE-2020-36472 · Other software · Max7301 Project · reported by MITREMedium 5.9
An issue was discovered in the max7301 crate before 0.2.0 for Rust. The ImmediateIO and TransactionalIO types implement Sync for all Expander<EI> types that they contain.
Product
Max7301
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the generator crate before 0.7.0 for Rust.CVE-2020-36471 · Other software · Generator Project · reported by MITREMedium 5.9
An issue was discovered in the generator crate before 0.7.0 for Rust. It does not ensure that a function (for yielding values) has Send bounds.
Product
Generator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the disrustor crate through 2020-12-17 for Rust.CVE-2020-36470 · Other software · Disrustor Project · reported by MITREMedium 5.9
An issue was discovered in the disrustor crate through 2020-12-17 for Rust. RingBuffer doe not properly limit the number of mutable references.
Product
Disrustor
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the appendix crate through 2020-11-15 for Rust.CVE-2020-36469 · Other software · Appendix Project · reported by MITREMedium 5.9
An issue was discovered in the appendix crate through 2020-11-15 for Rust. For the generic K and V type parameters, Send and Sync are implemented unconditionally.
Product
Appendix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the cgc crate through 2020-12-10 for Rust.CVE-2020-36468 · Other software · CGC Project · reported by MITREMedium 5.9
An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::write performs non-atomic write operations on an underlying pointer.
Product
CGC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the cgc crate through 2020-12-10 for Rust.CVE-2020-36467 · Other software · CGC Project · reported by MITREMedium 5.9
An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr::get returns more than one mutable reference to the same object.
Product
CGC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the cgc crate through 2020-12-10 for Rust.CVE-2020-36466 · Other software · CGC Project · reported by MITREMedium 5.9
An issue was discovered in the cgc crate through 2020-12-10 for Rust. Ptr implements Send and Sync for all types.
Product
CGC
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the generic-array crate before 0.13.3 for Rust.CVE-2020-36465 · Other software · Generic-array Project · reported by MITREHigh 7.5
An issue was discovered in the generic-array crate before 0.13.3 for Rust. It violates soundness by using the arr! macro to extend lifetimes.
Product
Generic-array
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the heapless crate before 0.6.1 for Rust.CVE-2020-36464 · Other software · Heapless Project · reported by MITREHigh 7.5
An issue was discovered in the heapless crate before 0.6.1 for Rust. The IntoIter Clone implementation clones an entire underlying Vec without considering whether it has already been partially consumed.
Product
Heapless
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the multiqueue crate through 2020-12-25 for Rust.CVE-2020-36463 · Other software · Multiqueue Project · reported by MITREHigh 8.1
An issue was discovered in the multiqueue crate through 2020-12-25 for Rust. There are unconditional implementations of Send for InnerSend<RW, T>, InnerRecv<RW, T>, FutInnerSend<RW, T>, and FutInnerRecv<RW, T>.
Product
Multiqueue
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the syncpool crate before 0.1.6 for Rust.CVE-2020-36462 · Other software · Syncpool Project · reported by MITREHigh 8.1
An issue was discovered in the syncpool crate before 0.1.6 for Rust. There is an unconditional implementation of Send for Bucket2.
Product
Syncpool
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the noise_search crate through 2020-12-10 for Rust.CVE-2020-36461 · Other software · Noise Search Project · reported by MITREHigh 8.1
An issue was discovered in the noise_search crate through 2020-12-10 for Rust. There are unconditional implementations of Send and Sync for MvccRwLock.
Product
Noise Search
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the model crate through 2020-11-10 for Rust.CVE-2020-36460 · Other software · Model Project · reported by MITREHigh 8.1
An issue was discovered in the model crate through 2020-11-10 for Rust. The Shared data structure has an implementation of the Send and Sync traits without regard for the inner type.
Product
Model
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the dces crate through 2020-12-09 for Rust.CVE-2020-36459 · Other software · Dces Project · reported by MITREHigh 8.1
An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore.
Product
Dces
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the lexer crate through 2020-11-10 for Rust.CVE-2020-36458 · Other software · Lexer Project · reported by MITREHigh 8.1
An issue was discovered in the lexer crate through 2020-11-10 for Rust. For ReaderResult<T, E>, there is an implementation of Sync with a trait bound of T: Send, E: Send.
Product
Lexer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the lever crate before 0.1.1 for Rust.CVE-2020-36457 · Other software · Lever Project · reported by MITREHigh 8.1
An issue was discovered in the lever crate before 0.1.1 for Rust. AtomicBox<T> implements the Send and Sync traits for all types T.
Product
Lever
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the toolshed crate through 2020-11-15 for Rust.CVE-2020-36456 · Other software · Toolshed Project · reported by MITREHigh 8.1
An issue was discovered in the toolshed crate through 2020-11-15 for Rust. In CopyCell<T>, the Send trait lacks bounds on the contained type.
Product
Toolshed
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the slock crate through 2020-11-17 for Rust.CVE-2020-36455 · Other software · Brokenlamp · reported by MITREHigh 8.1
An issue was discovered in the slock crate through 2020-11-17 for Rust. Slock<T> unconditionally implements Send and Sync.
Product
Slock
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the parc crate through 2020-11-14 for Rust.CVE-2020-36454 · Other software · Parc Project · reported by MITREHigh 8.1
An issue was discovered in the parc crate through 2020-11-14 for Rust. LockWeak<T> has an unconditional implementation of Send without trait bounds on T.
Product
Parc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the scottqueue crate through 2020-11-15 for Rust.CVE-2020-36453 · Other software · Scottqueue Project · reported by MITREHigh 8.1
An issue was discovered in the scottqueue crate through 2020-11-15 for Rust. There are unconditional implementations of Send and Sync for Queue<T>.
Product
Scottqueue
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the array-tools crate before 0.3.2 for Rust.CVE-2020-36452 · Other software · Array-tools Project · reported by MITRECritical 9.8
An issue was discovered in the array-tools crate before 0.3.2 for Rust. FixedCapacityDequeLike::clone() has a drop of uninitialized memory.
Product
Array-tools
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org
Aug 8, 2021An issue was discovered in the rcu_cell crate through 2020-11-14 for Rust.CVE-2020-36451 · Other software · RCU Cell Project · reported by MITREHigh 8.1
An issue was discovered in the rcu_cell crate through 2020-11-14 for Rust. There are unconditional implementations of Send and Sync for RcuCell<T>.
Product
RCU Cell
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record raw.githubusercontent.com rustsec.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.