nushell

4 results · Clear filters · Feed

• Critical 10.0
  CVE-2026-115905 Public exploit

  zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

  zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling th…

  zip-rs zip2 rust pixi Debian Ubuntu Azure Linux Wolfi crates.io
  Oct 26, 2026
• Medium 6.8
  CVE-2026-111943 Public exploit

  Distrust compromised intermediate certificates in crypto/x509

  On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

  Go standard library crypto/x509 renovate golang Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io
  Oct 21, 2026
• High 8.8
  CVE-2026-42559 Public exploit

  RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

  RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious publ…

  Model Context Protocol rust-sdk zed nushell Wolfi npm crates.io
  May 14, 2026
• Medium 5.5
  CVE-2026-25541 Public exploit

  Bytes is vulnerable to integer overflow in BytesMut::reserve

  Bytes is a utility library for working with bytes. From version 1.2.1 to before 1.11.1, Bytes is vulnerable to integer overflow in BytesMut::reserve. In the unique reclaim path of BytesMut::reserve, if the condition "v_capacity >= new_cap + offset" uses an un…

  tokio-rs bytes rust kata-containers Debian Ubuntu Azure Linux Wolfi crates.io
  Feb 4, 2026