Update version for unstable for CVE-2019-16760

Open questions: src:rust-cargo as well an issue? And is it needed to
track as well the rustc package? According to the upstream advisory bot
hat https://rustsec.org/advisories/CVE-2019-16760.html and the
oss-security post
https://marc.info/?l=oss-security&m=157055118009441&w=2 mention rust
releases before 1.26.0 as well.