Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

544new WordPress flaws this week

391,181entries in the database

442 results · page 6 of 9

Mar 5, 2021An issue was discovered in the truetype crate before 0.30.1 for Rust.CVE-2021-28030 · Other software · Truetype Project · reported by MITREHigh 7.5
An issue was discovered in the truetype crate before 0.30.1 for Rust. Attackers can read the contents of uninitialized memory locations via a user-provided Read operation within Tape::take_bytes.
Product
Truetype
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Mar 5, 2021An issue was discovered in the toodee crate before 0.3.0 for Rust.CVE-2021-28029 · Other software · Toodee Project · reported by MITREHigh 7.5
An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
Product
Toodee
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Mar 5, 2021An issue was discovered in the toodee crate before 0.3.0 for Rust.CVE-2021-28028 · Other software · Toodee Project · reported by MITRECritical 9.8
An issue was discovered in the toodee crate before 0.3.0 for Rust. Row insertion can cause a double free upon an iterator panic.
Product
Toodee
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Mar 5, 2021An issue was discovered in the bam crate before 0.1.3 for Rust.CVE-2021-28027 · Other software · BAM Project · reported by MITRECritical 9.8
An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
Product
BAM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 24, 2021An issue was discovered in the comrak crate before 0.9.1 for Rust.CVE-2021-27671 · Other software · Comrak Project · reported by MITREMedium 6.1
An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing (for example) Data: to be used in an attack.
Product
Comrak
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 17, 2021An issue was discovered in the rand_core crate before 0.6.2 for Rust.CVE-2021-27378 · Other software · Rand Core Project · reported by MITRECritical 9.8
An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data.
Product
Rand Core
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 17, 2021An issue was discovered in the yottadb crate before 1.2.0 for Rust.CVE-2021-27377 · Other software · Yottadb · reported by MITRECritical 9.8
An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.
Product
Yottadb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 17, 2021An issue was discovered in the nb-connect crate before 1.0.3 for Rust.CVE-2021-27376 · Other software · Nb-connect Project · reported by MITRECritical 9.8
An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures.
Product
Nb-connect
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 11, 2021hyper is an open-source HTTP library for Rust (crates.io).CVE-2021-21299 · Other software · hyperium · reported by GitHubMedium 4.8
hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that can enable a request smuggling attack. The HTTP server code had a flaw that incorrectly understands some requests with multiple transfer-encoding headers to have a chunked payload, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that understands the request payload boundary differently can result in "request smuggling" or "desync attacks". To determine if vulnerable, all these things must be true: 1) Using hyper as an HTTP server (the client is not affected), 2) Using HTTP/1.1 (HTTP/2 does not use transfer-encoding), 3) Using a vulnerable HTTP proxy upstream to hyper. If an upstream proxy correctly rejects the illegal transfer-encoding headers, the desync attack cannot succeed. If there is no proxy upstream of hyper, hyper cannot start the desync attack, as the client will repair the headers before forwarding. This is fixed in versions 0.14.3 and 0.13.10. As a workaround one can take the following options: 1) Reject requests that contain a `transfer-encoding` header, 2) Ensure any upstrea
Product
hyper
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record crates.io github.com
Feb 9, 2021An issue was discovered in the xcb crate through 2021-02-04 for Rust.CVE-2021-26958 · Other software · XCB Project · reported by MITREHigh 8.8
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because transmutation to the wrong type can happen after xcb::base::cast_event uses std::mem::transmute to return a reference to an arbitrary type.
Product
XCB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 9, 2021An issue was discovered in the xcb crate through 2021-02-04 for Rust.CVE-2021-26957 · Other software · XCB Project · reported by MITRECritical 9.8
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because there is an out-of-bounds read in xcb::xproto::change_property(), as demonstrated by a format=32 T=u8 situation where out-of-bounds bytes are sent to an X server.
Product
XCB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 9, 2021An issue was discovered in the xcb crate through 2021-02-04 for Rust.CVE-2021-26956 · Other software · XCB Project · reported by MITRECritical 9.8
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because bytes from an X server can be interpreted as any data type returned by xcb::xproto::GetPropertyReply::value.
Product
XCB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 9, 2021An issue was discovered in the xcb crate through 2021-02-04 for Rust.CVE-2021-26955 · Other software · XCB Project · reported by MITRECritical 9.8
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
Product
XCB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 9, 2021An issue was discovered in the qwutils crate before 0.3.1 for Rust.CVE-2021-26954 · Other software · Qwutils Project · reported by MITREMedium 5.3
An issue was discovered in the qwutils crate before 0.3.1 for Rust. When a Clone panic occurs, insert_slice_clone can perform a double drop.
Product
Qwutils
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 9, 2021An issue was discovered in the postscript crate before 0.14.0 for Rust.CVE-2021-26953 · Other software · Postscript Project · reported by MITREHigh 7.5
An issue was discovered in the postscript crate before 0.14.0 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via a user-provided Read implementation.
Product
Postscript
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 9, 2021An issue was discovered in the ms3d crate before 0.1.3 for Rust.CVE-2021-26952 · Other software · Ms3d Project · reported by MITREHigh 7.5
An issue was discovered in the ms3d crate before 0.1.3 for Rust. It might allow attackers to obtain sensitive information from uninitialized memory locations via IoReader::read.
Product
Ms3d
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Feb 9, 2021An issue was discovered in the calamine crate before 0.17.0 for Rust.CVE-2021-26951 · Other software · Calamine Project · reported by MITRECritical 9.8
An issue was discovered in the calamine crate before 0.17.0 for Rust. It allows attackers to overwrite heap-memory locations because Vec::set_len is used without proper memory claiming, and this uninitialized memory is used for a user-provided Read operation, as demonstrated by Sectors::get.
Product
Calamine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 28, 2021An issue was discovered in the marc crate before 2.0.0 for Rust.CVE-2021-26308 · Other software · Marc Project · reported by MITREHigh 7.5
An issue was discovered in the marc crate before 2.0.0 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated memory, violating soundness.
Product
Marc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 28, 2021An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust.CVE-2021-26307 · Other software · Raw-cpuid Project · reported by MITREMedium 5.5
An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It allows __cpuid_count() calls even if the processor does not support the CPUID instruction, which is unsound and causes a deterministic crash.
Product
Raw-cpuid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 28, 2021An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust.CVE-2021-26306 · Other software · Raw-cpuid Project · reported by MITREHigh 7.5
An issue was discovered in the raw-cpuid crate before 9.0.0 for Rust. It has unsound transmute calls within as_string() methods.
Product
Raw-cpuid
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 28, 2021An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust.CVE-2021-26305 · Other software · CDR Project · reported by MITRECritical 9.8
An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.
Product
CDR
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust.CVE-2021-25908 · Other software · Fil-ocl Project · reported by MITREHigh 7.5
An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. From<EventList> can lead to a double free.
Product
Fil-ocl
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the containers crate before 0.9.11 for Rust.CVE-2021-25907 · Other software · Containers Project · reported by MITRECritical 9.8
An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::{mutate,mutate2} double drop can be performed.
Product
Containers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust.CVE-2021-25906 · Other software · Basic DSP Matrix Project · reported by MITREHigh 7.5
An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed.
Product
Basic DSP Matrix
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the bra crate before 0.1.1 for Rust.CVE-2021-25905 · Other software · BRA Project · reported by MITRECritical 9.1
An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory.
Product
BRA
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the av-data crate before 0.3.0 for Rust.CVE-2021-25904 · Other software · Av-data Project · reported by MITREHigh 7.5
An issue was discovered in the av-data crate before 0.3.0 for Rust. A raw pointer is dereferenced, leading to a read of an arbitrary memory address, sometimes causing a segfault.
Product
Av-data
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the cache crate through 2021-01-01 for Rust.CVE-2021-25903 · Other software · Cache Project · reported by MITREHigh 7.5
An issue was discovered in the cache crate through 2021-01-01 for Rust. A raw pointer is dereferenced.
Product
Cache
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the glsl-layout crate before 0.4.0 for Rust.CVE-2021-25902 · Other software · Glsl-layout Project · reported by MITREHigh 7.5
An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. When a panic occurs, map_array can perform a double drop.
Product
Glsl-layout
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the lazy-init crate through 2021-01-17 for Rust.CVE-2021-25901 · Other software · Lazy-init Project · reported by MITREMedium 5.3
An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race.
Product
Lazy-init
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust.CVE-2021-25900 · Other software · Servo · reported by MITRECritical 9.8
An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many.
Product
Smallvec
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the va-ts crate before 0.0.4 for Rust.CVE-2020-36220 · Other software · Va-ts Project · reported by MITREMedium 5.9
An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occur.
Product
Va-ts
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the atomic-option crate through 2020-10-31 for Rust.CVE-2020-36219 · Other software · Atomic-option Project · reported by MITREMedium 5.9
An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption<T> implements Sync unconditionally, a data race can occur.
Product
Atomic-option
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the buttplug crate before 1.0.4 for Rust.CVE-2020-36218 · Other software · Nonpolynomial · reported by MITREMedium 5.9
An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider (!Send|!Sync) objects, leading to a data race.
Product
Buttplug
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the may_queue crate through 2020-11-10 for Rust.CVE-2020-36217 · Other software · MAY Queue Project · reported by MITREMedium 5.9
An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait, memory corruption can occur.
Product
MAY Queue
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust.CVE-2020-36216 · Other software · Petabi · reported by MITREMedium 5.9
An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust. Because a non-Send type can be sent to a different thread, a data race and memory corruption can occur.
Product
Eventio
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the hashconsing crate before 1.1.0 for Rust.CVE-2020-36215 · Other software · Hashconsing Project · reported by MITREHigh 7.5
An issue was discovered in the hashconsing crate before 1.1.0 for Rust. Because HConsed does not have bounds on its Send trait or Sync trait, memory corruption can occur.
Product
Hashconsing
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust.CVE-2020-36214 · Other software · Multiqueue2 Project · reported by MITREMedium 5.9
An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. Because a non-Send type can be sent to a different thread, a data race can occur.
Product
Multiqueue2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the abi_stable crate before 0.9.1 for Rust.CVE-2020-36213 · Other software · ABI Stable Project · reported by MITREHigh 7.5
An issue was discovered in the abi_stable crate before 0.9.1 for Rust. A retain call can create an invalid UTF-8 string, violating soundness.
Product
ABI Stable
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the abi_stable crate before 0.9.1 for Rust.CVE-2020-36212 · Other software · ABI Stable Project · reported by MITREHigh 7.5
An issue was discovered in the abi_stable crate before 0.9.1 for Rust. DrainFilter lacks soundness because of a double drop.
Product
ABI Stable
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the gfwx crate before 0.3.0 for Rust.CVE-2020-36211 · Other software · Devolutions · reported by MITREHigh 7
An issue was discovered in the gfwx crate before 0.3.0 for Rust. Because ImageChunkMut does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
Product
Gfwx
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the autorand crate before 0.2.3 for Rust.CVE-2020-36210 · Other software · Autorand Project · reported by MITREHigh 7.8
An issue was discovered in the autorand crate before 0.2.3 for Rust. Because of impl Random on arrays, uninitialized memory can be dropped when a panic occurs, leading to memory corruption.
Product
Autorand
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the late-static crate before 0.4.0 for Rust.CVE-2020-36209 · Other software · Late-static Project · reported by MITREHigh 7
An issue was discovered in the late-static crate before 0.4.0 for Rust. Because Sync is implemented for LateStatic with T: Send, a data race can occur.
Product
Late-static
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the conquer-once crate before 0.3.2 for Rust.CVE-2020-36208 · Other software · Conquer-once Project · reported by MITREHigh 7.8
An issue was discovered in the conquer-once crate before 0.3.2 for Rust. Thread crossing can occur for a non-Send but Sync type, leading to memory corruption.
Product
Conquer-once
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the aovec crate through 2020-12-10 for Rust.CVE-2020-36207 · Other software · Aovec Project · reported by MITREHigh 7
An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec<T> does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
Product
Aovec
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the rusb crate before 0.7.0 for Rust.CVE-2020-36206 · Other software · Rusb Project · reported by MITREHigh 7
An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur.
Product
Rusb
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the xcb crate through 2020-12-10 for Rust.CVE-2020-36205 · Other software · XCB Project · reported by MITREMedium 5.5
An issue was discovered in the xcb crate through 2020-12-10 for Rust. base::Error does not have soundness. Because of the public ptr field, a use-after-free or double-free can occur.
Product
XCB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the im crate through 2020-11-09 for Rust.CVE-2020-36204 · Other software · IM Project · reported by MITREMedium 4.7
An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
Product
IM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the reffers crate through 2020-12-01 for Rust.CVE-2020-36203 · Other software · Reffers Project · reported by MITREMedium 4.7
An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race and memory corruption.
Product
Reffers
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Jan 26, 2021An issue was discovered in the async-h1 crate before 2.3.0 for Rust.CVE-2020-36202 · Other software · Rust-lang · reported by MITREMedium 6.1
An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy.
Product
Async-h1
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org
Dec 31, 2020An issue was discovered in the atom crate before 0.3.6 for Rust.CVE-2020-35897 · Other software · Atom Project · reported by MITREMedium 4.7
An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send implementation allows a cross-thread data race.
Product
Atom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rustsec.org rustsec.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.