https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T14:20:33.352171+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-04012 cnvd-2022-04012 2026-10-16T14:20:33.414416+00:00 cnvd-2022-04012 https://cve.radiocsirt.org/vuln/euvd-2026-33574 EUVD-2026-33574 2026-10-16T14:20:33.414457+00:00 EUVD-2026-33574 https://cve.radiocsirt.org/vuln/fkie_cve-2021-45716 fkie_cve-2021-45716 2026-10-16T14:20:33.414482+00:00

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free.

 https://cve.radiocsirt.org/vuln/ghsa-cm8g-544f-p9x9 GHSA-cm8g-544f-p9x9 — Use After Free in rusqlite 2026-10-16T14:20:33.414512+00:00

Affected: crates.io: rusqlite

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free.

 https://cve.radiocsirt.org/vuln/gsd-2021-45716 gsd-2021-45716 2026-10-16T14:20:33.414537+00:00 gsd-2021-45716 https://cve.radiocsirt.org/vuln/rustsec-2021-0128 RUSTSEC-2021-0128 — Incorrect Lifetime Bounds on Closures in `rusqlite` 2026-10-16T14:20:33.414549+00:00

Affected: crates.io: rusqlite

The lifetime bound on several closure-accepting `rusqlite` functions (specifically, functions which register a callback to be later invoked by SQLite) was too relaxed. If a closure referencing borrowed values on the stack is was passed to one of these functions, it could allow Rust code to access objects on the stack after they have been dropped.

The impacted functions are:

- Under `cfg(feature = "functions")`: `Connection::create_scalar_function`, `Connection::create_aggregate_function` and `Connection::create_window_function`. - Under `cfg(feature = "hooks")`: `Connection::commit_hook`, `Connection::rollback_hook` and `Connection::update_hook`. - Under `cfg(feature = "collation")`: `Connection::create_collation`.

The issue exists in all `0.25.*` versions prior to `0.25.4`, and all `0.26.*` versions prior to 0.26.2 (specifically: `0.25.0`, `0.25.1`, `0.25.2`, `0.25.3`, `0.26.0`, and `0.26.1`).

The fix is available in versions `0.26.2` and newer, and also has been back-ported to `0.25.4`. As it does not exist in `0.24.*`, all affected versions should have an upgrade path to a semver-compatible release.