Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-116794Highrussh: russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationCVE-2026-116775Lowpageant: pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)CVE-2026-116774Mediumrussh: russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)CVE-2026-116696Lowrussh: russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesCVE-2026-116773Mediumrussh: russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsCVE-2026-115907Highzip: zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeCVE-2026-115908Highzip: zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. CVE-2026-115906Mediumzip: zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115909Highzip: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionGHSA-C33X-VCV4-VG3GLowcedar-policy: Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergenceCVE-2026-115893Criticalwasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionCVE-2026-115905Criticalzip: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…GHSA-VP88-798V-H67FLowrustls: rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alertGHSA-W44R-93J7-QV28Lowrustls: rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 shareGHSA-C8M5-C952-6CM4Mediumrustls: Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKsGHSA-H2V8-394M-P7VVLowrustls: Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.CVE-2026-115892Mediumwasmtime: Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typeCVE-2026-115889Criticalwasmtime: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationGHSA-H4FR-CMH5-QR62Lowfallow: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootCVE-2026-115569Lowfallow: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootCVE-2026-115567Mediumtokio: Tokio: Race condition in `tokio::time::Interval`GHSA-Q54R-JF2P-RFR2Highgix: gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()CVE-2026-96889Highlibrsvg: Librsvg: Use-after-free when XML includes have duplicated entitiesCVE-2026-63430Mediumammonia: ammonia: mXSS via MathML `annotation-xml` encoding stripCVE-2026-113799Mediumslack-morphism: Slack Morphism verifier errors disclose valid HMACs in the logs

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo