rust vulnerabilities

Products

• cargo 1
• pageant 1

Latest rust CVEs

Newest publication first

1. CVE-2026-102820 pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

   Published 2026-09-29

   Medium·CVSS 6.2 EPSS 0.19%

   pageant provides a [PageantStream] type that implements [AsyncRead] and [AsyncWrite] traits and can be used to talk to a running Pageant instance. Prior to pageant 0.2.3, the Windows pageant crate's pageant/src/wmmessage.rs MemoryMap::read function trusts a peer-controlled u32 re...

2. CVE-2019-16760 Cargo prior to Rust 1.26.0 may download the wrong dependency

   Published 2019-09-30

   High·CVSS 7.5 EPSS 1.3%

   Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the package configuration key. Usage of the package key to rename dependencies in Cargo.toml is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.