# crates.io Advisories. Every crates.io Advisory we hold (Rust), newest first. ## Records, newest first (an older page) - [pqc_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery](https://agentprime.io/advisories/RUSTSEC-2026-0290.md) `RUSTSEC-2026-0290` · crates.io `pqc_kyber`: affected `>=0.0.0-0`, no fixed version yet · CVSS 7.4 High · Not analysed yet · Published 16 Aug 2026 - [cosmian_kyber: AVX2 backend skips Fujisaki-Okamoto implicit rejection, enabling chosen-ciphertext key recovery](https://agentprime.io/advisories/RUSTSEC-2026-0288.md) `RUSTSEC-2026-0288` · crates.io `cosmian_kyber`: affected `>=0.0.0-0`, no fixed version yet · CVSS 7.4 High · Not analysed yet · Published 16 Aug 2026 - [Legacy \`azure_core\` writes the \`authorization\` header value to logs](https://agentprime.io/advisories/RUSTSEC-2026-0275.md) `RUSTSEC-2026-0275` · crates.io `azure_core`: affected `>=0.0.0-0, <0.2.0 || >=0.2.1-0, <0.22.0`, fixed in `0.2.0`, `0.22.0` · CVSS 6.5 Medium · Not analysed yet · Published 15 Aug 2026 - [s2n-quic has excessive memory allocation](https://agentprime.io/advisories/GHSA-9q54-f358-3fqf.md) `GHSA-9q54-f358-3fqf`, `CVE-2026-10740` · crates.io `s2n-quic`: affected `<1.82.0`, fixed in `1.82.0` · CVSS 6.9 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service - [SurrealDB: Array element-level (field.\*) SELECT permissions leak denied elements to record users](https://agentprime.io/advisories/GHSA-8rw6-p7m8-63jp.md) `GHSA-8rw6-p7m8-63jp`, `CVE-2026-63740` · crates.io `surrealdb`: affected `<3.1.4`, fixed in `3.1.4` · CVSS 7.1 High · Not analysed yet · Published 14 Aug 2026 · Tags: Broken access control - [BIP-322 address ownership verification bypass for P2WPKH and P2SH-P2WPKH addresses](https://agentprime.io/advisories/GHSA-5chw-87w3-j9cv.md) `GHSA-5chw-87w3-j9cv`, `RUSTSEC-2026-0334` · crates.io `bip322`: affected `>=0.0.6, <0.0.11`, fixed in `0.0.11` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 - [nimiq-blockchain: Validity store off by one error](https://agentprime.io/advisories/GHSA-3763-qp59-59vf.md) `GHSA-3763-qp59-59vf`, `CVE-2026-46369` · crates.io `nimiq-blockchain`: affected `<1.5.1`, fixed in `1.5.1` · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: Authentication bypass, CWE-193 - [Memory corruption bug on \`ApplyResult\` type](https://agentprime.io/advisories/RUSTSEC-2026-0295.md) `RUSTSEC-2026-0295` · crates.io `z3`: affected `>=0.0.0-0, <0.21.0`, fixed in `0.21.0` · No CVSS score · Not analysed yet · Published 12 Aug 2026 - [\`sp-sized-chunks\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0270.md) `RUSTSEC-2026-0270` · crates.io `sp-sized-chunks`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 11 Aug 2026 - [Panic-safety unsoundness in \`truncate_back\`, \`truncate_front\`, \`clear\`, and \`extend_from_slice\` (use-after-free / double-free)](https://agentprime.io/advisories/RUSTSEC-2026-0256.md) `RUSTSEC-2026-0256` · crates.io `circular-buffer`: affected `>=0.0.0-0, <2.0.1`, fixed in `2.0.1` · No CVSS score · Not analysed yet · Published 11 Aug 2026 - [Panic-safety unsoundness in \`Chunk\`, \`RingBuffer\`, and \`InlineArray\` (use-after-free / double-free)](https://agentprime.io/advisories/RUSTSEC-2026-0255.md) `RUSTSEC-2026-0255` · crates.io `sized-chunks`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 11 Aug 2026 - [Panic-safety unsoundness in \`Chunk\` and \`InlineArray\` (use-after-free / double-free)](https://agentprime.io/advisories/RUSTSEC-2026-0254.md) `RUSTSEC-2026-0254` · crates.io `sp-sized-chunks`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 11 Aug 2026 - [Panic-safety unsoundness in \`SplitVec::extend_from_slice\` (uninitialized read)](https://agentprime.io/advisories/RUSTSEC-2026-0252.md) `RUSTSEC-2026-0252` · crates.io `orx-split-vec`: affected `>=0.0.0-0, <4.0.0`, fixed in `4.0.0` · No CVSS score · Not analysed yet · Published 11 Aug 2026 - [Low-level GCM ignores the operation nonce](https://agentprime.io/advisories/GHSA-h9f2-fgp8-vc4h.md) `GHSA-h9f2-fgp8-vc4h`, `RUSTSEC-2026-0238` · crates.io `dcrypt-algorithms`: affected `>=0.0.0-0, <2.0.0`, fixed in `2.0.0` · No CVSS score · Not analysed yet · Published 9 Aug 2026 - [Streaming AEAD does not authenticate stream structure](https://agentprime.io/advisories/GHSA-8cwp-4826-jg9f.md) `GHSA-8cwp-4826-jg9f`, `RUSTSEC-2026-0239` · crates.io `dcrypt-symmetric`: affected `>=0.0.0-0, <2.0.0`, fixed in `2.0.0` · No CVSS score · Not analysed yet · Published 9 Aug 2026 - [Ed25519 identity public keys permit universal signature forgery](https://agentprime.io/advisories/GHSA-7j32-2mpw-c784.md) `GHSA-7j32-2mpw-c784`, `RUSTSEC-2026-0240` · crates.io `dcrypt-sign`: affected `>=0.0.0-0, <2.0.0`, fixed in `2.0.0` · No CVSS score · Not analysed yet · Published 9 Aug 2026 - [Safe ErrorRegistry APIs can cause undefined behavior](https://agentprime.io/advisories/GHSA-7hc7-h3f2-r4j6.md) `GHSA-7hc7-h3f2-r4j6`, `RUSTSEC-2026-0242` · crates.io `dcrypt-api`: affected `>=0.0.0-0, <2.0.0`, fixed in `2.0.0` · No CVSS score · Not analysed yet · Published 9 Aug 2026 - [Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences](https://agentprime.io/advisories/GHSA-3c48-9r95-hqhr.md) `GHSA-3c48-9r95-hqhr`, `RUSTSEC-2026-0345` · crates.io `kuva`: affected `>=0.1.5, <0.3.1 || >=0.4.0, <0.4.1`, fixed in `0.3.1`, `0.4.1` · No CVSS score · Not analysed yet · Published 7 Aug 2026 - [\`sevenz-rust\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0246.md) `RUSTSEC-2026-0246` · crates.io `sevenz-rust`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 6 Aug 2026 - [Relative/Absolute Path Traversal (CWE-23/CWE-36) in \`decompress_impl\` that enables an arbitrary file write.](https://agentprime.io/advisories/RUSTSEC-2026-0245.md) `RUSTSEC-2026-0245` · crates.io `sevenz-rust`: affected `>=0.0.0-0`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 6 Aug 2026 - [\`setlocale\` and \`TextDomain::init\` are unsound as they access environment with no synchronization](https://agentprime.io/advisories/RUSTSEC-2026-0244.md) `RUSTSEC-2026-0244` · crates.io `gettext-rs`: affected `>=0.0.0-0, <0.8.0`, fixed in `0.8.0` · No CVSS score · Not analysed yet · Published 6 Aug 2026 - [A \`BigInt\` division panics, and two neighbouring operations answer wrongly in silence](https://agentprime.io/advisories/GHSA-6976-qm5m-7mcj.md) `GHSA-6976-qm5m-7mcj`, `RUSTSEC-2026-0236` · crates.io `viperjs`: affected `>=0.0.0-0, <0.2.2`, fixed in `0.2.2` · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 - [Double free / use-after-free in \`ReadChunk::commit\` when an element's \`Drop\` panics](https://agentprime.io/advisories/RUSTSEC-2026-0274.md) `RUSTSEC-2026-0274` · crates.io `rtrb`: affected `>=0.0.0-0, <0.3.5 || >=0.4.0-0, <0.4.0`, fixed in `0.3.5`, `0.4.0` · No CVSS score · Not analysed yet · Published 4 Aug 2026 - [Russh: Channel-scoped server callbacks can be reached without an open channel](https://agentprime.io/advisories/GHSA-m65r-rprj-r5rg.md) `GHSA-m65r-rprj-r5rg`, `CVE-2026-68930` · crates.io `russh`: affected `<0.62.5`, fixed in `0.62.5` · CVSS 6.5 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Broken access control, CWE-666, CWE-696 - [Auto-Reseeding HMAC-DRBG could panic for some output lengths](https://agentprime.io/advisories/RUSTSEC-2026-0329.md) `RUSTSEC-2026-0329` · crates.io `libcrux-hmac-drbg`: affected `>=0.0.0-0, <0.0.2`, fixed in `0.0.2` · CVSS 4.0, no score published · Not analysed yet · Published 3 Aug 2026 - [\`nostr-relay-pool\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0243.md) `RUSTSEC-2026-0243` · crates.io `nostr-relay-pool`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 3 Aug 2026 - [\`nostr-keyring\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0241.md) `RUSTSEC-2026-0241` · crates.io `nostr-keyring`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 3 Aug 2026 - [\`nostr-relay-builder\` is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0237.md) `RUSTSEC-2026-0237` · crates.io `nostr-relay-builder`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 3 Aug 2026 - [Processing of unverified relay events](https://agentprime.io/advisories/RUSTSEC-2026-0232.md) `RUSTSEC-2026-0232` · crates.io `nostr-relay-pool`: affected `>=0.0.0-0, <0.44.3`, fixed in `0.44.3` · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2026 - [Relay authentication challenges can exhaust memory](https://agentprime.io/advisories/RUSTSEC-2026-0231.md) `RUSTSEC-2026-0231` · crates.io `nostr-relay-pool`: affected `>=0.0.0-0, <0.44.3`, fixed in `0.44.3` · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2026 - [Empty NIP-50 search filters can panic](https://agentprime.io/advisories/RUSTSEC-2026-0230.md) `RUSTSEC-2026-0230` · crates.io `nostr`: affected `>=0.0.0-0, <0.44.7`, fixed in `0.44.7` · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2026 - [NIP-98 authorization parsing permits resource exhaustion](https://agentprime.io/advisories/RUSTSEC-2026-0229.md) `RUSTSEC-2026-0229` · crates.io `nostr`: affected `>=0.0.0-0, <0.44.7`, fixed in `0.44.7` · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2026 - [NIP-04 parsing amplifies malformed ciphertext memory use](https://agentprime.io/advisories/RUSTSEC-2026-0228.md) `RUSTSEC-2026-0228` · crates.io `nostr`: affected `>=0.0.0-0, <0.44.7`, fixed in `0.44.7` · CVSS 4.3 Medium · Not analysed yet · Published 1 Aug 2026 - [NIP-44 v2 decryption permits resource exhaustion](https://agentprime.io/advisories/RUSTSEC-2026-0227.md) `RUSTSEC-2026-0227` · crates.io `nostr`: affected `>=0.0.0-0, <0.44.7`, fixed in `0.44.7` · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2026 - [Wallet event parsers accept unauthenticated events](https://agentprime.io/advisories/RUSTSEC-2026-0226.md) `RUSTSEC-2026-0226` · crates.io `nostr`: affected `>=0.0.0-0, <0.44.7`, fixed in `0.44.7` · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2026 - [Debug output exposes NIP-46 and NIP-60 credentials](https://agentprime.io/advisories/RUSTSEC-2026-0225.md) `RUSTSEC-2026-0225` · crates.io `nostr`: affected `>=0.0.0-0, <0.44.7`, fixed in `0.44.7` · CVSS 5.5 Medium · Not analysed yet · Published 1 Aug 2026 - [Verification cache poisoning allows forged Nostr events to bypass signature validation](https://agentprime.io/advisories/GHSA-f96q-5f6p-v7cj.md) `GHSA-f96q-5f6p-v7cj`, `RUSTSEC-2026-0224` · crates.io `nostr-relay-pool`: affected `>=0.0.0-0, <0.44.2`, fixed in `0.44.2` · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2026 - [zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth Limit](https://agentprime.io/advisories/GHSA-3whf-vgf2-9w6g.md) `GHSA-3whf-vgf2-9w6g` · crates.io `zaino-state`: affected `<0.4.1`, fixed in `0.4.1` · CVSS 4.0, no score published · Not analysed yet · Published 31 Jul 2026 · Tags: Denial of service - [Stores can mix up type indices between engines](https://agentprime.io/advisories/GHSA-hgjw-h833-99q9.md) `GHSA-hgjw-h833-99q9`, `CVE-2026-115393`, `RUSTSEC-2026-0222` · crates.io `wasmtime`: affected `>=0.0.0-0, <24.0.12 || >=25.0.0, <36.0.13 || >=37.0.0, <46.0.2 || >=47.0.0, <47.0.3`, fixed in `24.0.12`, `36.0.13`, `46.0.2`, `47.0.3` · CVSS 1.0 Low · Not analysed yet · Published 31 Jul 2026 · Tags: Memory corruption - [Preemption and traps during bulk operations enable breaking internal VM state](https://agentprime.io/advisories/GHSA-2hw9-mc66-jc2q.md) `GHSA-2hw9-mc66-jc2q`, `CVE-2026-104855`, `RUSTSEC-2026-0223` · crates.io `wasmtime`: affected `>=46.0.0, <46.0.2 || >=47.0.0, <47.0.3`, fixed in `46.0.2`, `47.0.3` · CVSS 2.0 Low · Not analysed yet · Published 31 Jul 2026 · Tags: Race condition - [Unix \`BROWSER\` handling allows browser argument injection](https://agentprime.io/advisories/GHSA-2ph8-5cr8-hr33.md) `GHSA-2ph8-5cr8-hr33`, `RUSTSEC-2026-0257` · crates.io `webbrowser`: affected `>=0.0.0-0, <1.2.2`, fixed in `1.2.2` · No CVSS score · Not analysed yet · Published 29 Jul 2026 - [skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source](https://agentprime.io/advisories/GHSA-6xx4-9wp6-65p7.md) `GHSA-6xx4-9wp6-65p7` · crates.io `skilo`: affected `>=0.5.0, <0.11.1`, fixed in `0.11.1` · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal, CWE-61 - [nono-cli'scregistry pack verification can fail open when provenance metadata is absent](https://agentprime.io/advisories/GHSA-hc4m-q9jh-xw4j.md) `GHSA-hc4m-q9jh-xw4j` · crates.io `nono-cli`: affected `<0.61.3`, fixed in `0.61.3` · CVSS 6.6 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-636 - [Remote Denial of Service via malformed NIP-04 IV](https://agentprime.io/advisories/GHSA-xg7c-246g-6qpv.md) `GHSA-xg7c-246g-6qpv`, `RUSTSEC-2026-0219` · crates.io `nostr`: affected `>=0.0.0-0, <0.44.6 || >=0.45.0-alpha.1, <0.45.0-alpha.6`, fixed in `0.44.6`, `0.45.0-alpha.6` · CVSS 7.5 High · Not analysed yet · Published 26 Jul 2026 - [Remote Denial of Service via malformed NIP‑44 v2 payload](https://agentprime.io/advisories/GHSA-hrqp-8w79-gwgw.md) `GHSA-hrqp-8w79-gwgw`, `RUSTSEC-2026-0216` · crates.io `nostr`: affected `>=0.0.0-0, <0.44.5 || >=0.45.0-alpha.1, <0.45.0-alpha.5`, fixed in `0.44.5`, `0.45.0-alpha.5` · CVSS 7.5 High · Not analysed yet · Published 25 Jul 2026 - [Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service](https://agentprime.io/advisories/GHSA-jvxp-qmx7-gjpx.md) `GHSA-jvxp-qmx7-gjpx`, `CVE-2026-16756` · crates.io `aws-smithy-http-server`: affected `<0.66.5`, fixed in `0.66.5` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Denial of service - [Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics](https://agentprime.io/advisories/GHSA-2625-rw7m-5q5x.md) `GHSA-2625-rw7m-5q5x` · crates.io `hubuum_client`: affected `<0.6.1`, fixed in `0.6.1` · CVSS 4.0, no score published · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure - [Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic](https://agentprime.io/advisories/GHSA-qqc3-94qv-7fw3.md) `GHSA-qqc3-94qv-7fw3` · crates.io `hubuum_client`: affected `>=0.3.0, <0.6.1`, fixed in `0.6.1` · CVSS 4.0, no score published · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-693 - [Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects](https://agentprime.io/advisories/GHSA-f45q-w629-wr25.md) `GHSA-f45q-w629-wr25` · crates.io `hubuum_client`: affected `>=0.0.1, <0.6.1`, fixed in `0.6.1` · CVSS 4.0, no score published · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure - [Russh: client wrong-length X25519 \`clone_from_slice\` panic (pre-auth DoS)](https://agentprime.io/advisories/GHSA-g9hv-x236-4qp3.md) `GHSA-g9hv-x236-4qp3`, `CVE-2026-73429` · crates.io `russh`: affected `<0.62.4`, fixed in `0.62.4` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-704, CWE-754 - [Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records](https://agentprime.io/advisories/GHSA-cqjc-rmpq-xprq.md) `GHSA-cqjc-rmpq-xprq`, `CVE-2026-73489` · crates.io `russh`: affected `<0.62.4`, fixed in `0.62.4` · CVSS 4.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-129 - [Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)](https://agentprime.io/advisories/GHSA-5xvq-cp9x-6p6r.md) `GHSA-5xvq-cp9x-6p6r`, `CVE-2026-73430` · crates.io `russh`: affected `<0.62.4`, fixed in `0.62.4` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-754 - [smallstr is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0215.md) `RUSTSEC-2026-0215` · crates.io `smallstr`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 22 Jul 2026 - [gumdrop is unmaintained](https://agentprime.io/advisories/RUSTSEC-2026-0214.md) `RUSTSEC-2026-0214` · crates.io `gumdrop`: affected `>=0.0.0-0`, no fixed version yet · No CVSS score · Not analysed yet · Published 22 Jul 2026 - [\`Enum\` trait allows type confusion when manually implemented](https://agentprime.io/advisories/RUSTSEC-2026-0218.md) `RUSTSEC-2026-0218` · crates.io `enum-map`: affected `>=3.0.0-0.gat.0, <3.1.0`, fixed in `3.1.0` · No CVSS score · Not analysed yet · Published 21 Jul 2026 - [XSS in ammonia via SVG \`animate\` and \`set\` animation tags](https://agentprime.io/advisories/GHSA-m6mh-2hw2-555x.md) `GHSA-m6mh-2hw2-555x`, `CVE-2026-102342`, `RUSTSEC-2026-0213` · crates.io `ammonia`: affected `>=0.0.0-0, <3.3.3 || >=4.0.0, <4.0.3 || >=4.1.0, <4.1.4`, fixed in `3.3.3`, `4.0.3`, `4.1.4` · CVSS 5.4 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS) - [Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects](https://agentprime.io/advisories/GHSA-m464-hj36-96vx.md) `GHSA-m464-hj36-96vx` · crates.io `surrealdb`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 20 Jul 2026 · Tags: Denial of service - [Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation](https://agentprime.io/advisories/GHSA-gw59-x2xr-wwvr.md) `GHSA-gw59-x2xr-wwvr` · crates.io `surrealdb`: affected `*`, no fixed version yet · CVSS 4.3 Medium · Withdrawn · Not analysed yet · Published 20 Jul 2026 · Tags: Weak cryptography or TLS - [Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries](https://agentprime.io/advisories/GHSA-mf42-3c8q-x7x8.md) `GHSA-mf42-3c8q-x7x8` · crates.io `surrealdb`: affected `*`, no fixed version yet · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 20 Jul 2026 · Tags: Broken access control - [Duplicate Advisory: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level](https://agentprime.io/advisories/GHSA-4f9v-jpx9-mjvw.md) `GHSA-4f9v-jpx9-mjvw` · crates.io `surrealdb`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 20 Jul 2026 · Tags: Broken access control Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .