Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 17:48:38 +0000 CVE-2026-5223 — Crates in third party registries can override the cached source of other crates https://vulnerability.circl.lu/vuln/cve-2026-5223 <p><strong>Affected:</strong> Rust Project Cargo</p> <p>Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.</p> <p><strong>Affected:</strong> Rust Project Cargo</p> <p>Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.</p> https://vulnerability.circl.lu/vuln/cve-2026-5223