Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-35364Mediumcoreutils: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition CVE-2026-35350Mediumcoreutils: uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails CVE-2026-35354Mediumcoreutils: uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition CVE-2026-35351Mediumcoreutils: uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries CVE-2026-35352Highcoreutils: uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition CVE-2026-35360Mediumcoreutils: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition CVE-2026-35359Mediumcoreutils: uutils coreutils has a Link Following issue CVE-2026-35357Mediumcoreutils: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition CVE-2026-35348Mediumcoreutils: uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths CVE-2026-35367Lowcoreutils: uutils coreutils has an Incorrect Permission Assignment for Critical Resource CVE-2026-35368Highcoreutils: uutils coreutils has an Untrusted Search Path CVE-2026-35345Mediumcoreutils: uutils coreutils has a Link Following Issue GHSA-XHJ4-VRGC-HR34Mediumactix-http: actix-http has HTTP/1.1 CL.TE Request Smuggling CVE-2026-41197Criticalbrillig: Brillig: Heap corruption in foreign call results with nested tuple arrays CVE-2026-41583Criticalzebrad: Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling CVE-2026-41585Mediumzebra-rpc: Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients CVE-2026-41584Criticalzebrad: Zebra has rk Identity Point Panic in Transaction Verification CVE-2026-40881Mediumzebrad: Zebra: addr/addrv2 Deserialization Resource Exhaustion CVE-2026-40880Highzebra-consensus: Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks GHSA-3G92-F9CH-QJCMLowp3-symmetric: Plonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of…GHSA-XGP8-3HG3-C2MHLowrustls-webpki: webpki: Name constraints were accepted for certificates asserting a wildcard name GHSA-965H-392X-2MH5Lowrustls-webpki: webpki: Name constraints for URI names were incorrectly accepted CVE-2026-6654Highthin-vec: thin-vec: Use-After-Free and Double Free in IntoIter::drop When Element Drop Panics GHSA-CQ8V-F236-94QCLowrand: Rand is unsound with a custom logger using rand::rng()CVE-2026-40323Highsp1_sdk: SP1 V6 Recursion Circuit Row-Count Binding Gap

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo