Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-34069Mediumnimiq-consensus: nimiq-consensus panics via RequestMacroChain micro-block locator CVE-2026-40093Criticalnimiq-blockchain: nimiq-blockchain is missing a wall-clock upper bound on block timestamps CVE-2026-35186Mediumwasmtime: Wasmtime has improperly masked return value from `table.grow` with Winch compiler backend CVE-2026-34987Criticalwasmtime: Wasmtime with Winch compiler backend on aarch64 may allow a sandbox-escaping memory access CVE-2026-35195Mediumwasmtime: Wasmtime has out-of-bounds write or crash when transcoding component model strings CVE-2026-34988Lowwasmtime: Wasmtime has data leakage between pooling allocator instances CVE-2026-34983Lowwasmtime: Wasmtime has use-after-free bug after cloning `wasmtime::Linker`CVE-2026-34971Criticalwasmtime: Wasmtime: Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift CVE-2026-34946Mediumwasmtime: Wasmtime has host panic when Winch compiler executes `table.fill`CVE-2026-34945Lowwasmtime: Wasmtime has host data leakage with 64-bit tables and Winch CVE-2026-34944Mediumwasmtime: Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64 CVE-2026-34943Mediumwasmtime: Wasmtime has a possible panic when lifting `flags` component value CVE-2026-34942Mediumwasmtime: Wasmtime: Panic when transcoding misaligned utf-16 strings CVE-2026-34941Mediumwasmtime: Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding CVE-2026-39360Mediumrustfs: RustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration CVE-2026-35533Highmise: Local settings bypass config trust checks CVE-2026-35406Highnetavark: netavark has incorrect error handling for malformed tcp packets CVE-2026-35457Highlibp2p-rendezvous: libp2p-rendezvous: Unbounded rendezvous DISCOVER cookies enable remote memory exhaustion CVE-2026-35405Highlibp2p-rendezvous: libp2p-rendezvous: Unlimited namespace registrations per peer enables OOM DoS on rendezvous servers GHSA-J3W3-P6MR-3HRHMediumdyn-future: DynFuture Drop Can Construct a Dangling Reference GHSA-2C6H-4899-WJXRHighscaly: scaly: Multiple soundness issues in Rust safe APIs CVE-2026-34377Highzebrad: Zebra has a Consensus Failure due to Improper Verification of V5 Transactions CVE-2026-34219Highlibp2p-gossipsub: libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling GHSA-FXC9-7J2W-VX54Criticalmpp: mpp has multiple payment bypass and griefing vulnerabilities CVE-2026-34202Criticalzebrad: Zebra node crash — V5 transaction hash panic (P2P reachable)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.