Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-8H58-W33P-WQ3GHighpgp: rPGP affected by crash in message handling for deeply nested messages GHSA-7587-4WV6-M68MHighpgp: rPGP vulnerable to parser crash on crafted RSA secret key packets through CVE-2026-21895 GHSA-G433-PQ76-6CMFHighhpke-rs: Bug fixes in hpke-rs, hpke-rs-rust-crypto GHSA-435G-FCV3-8J26Lowlibcrux-ecdh: Bug-Fixes in `libcrux-ecdh`, `libcrux-ed25519`, `libcrux-psq`GHSA-XX7M-69FF-9CRPMediumsurrealdb: SurrealDB vulnerable to Denial of Service through scripting function memory edge case GHSA-VGR2-R5HM-F6GFCriticalsha-rst: `sha-rst` was removed from crates.io for malicious code GHSA-6V2J-VR4H-F632Criticalfinch_cli_rust: `finch_cli_rust` was removed from crates.io for malicious code GHSA-XP79-9MXW-878JCriticalfinch-rst: `finch-rst` was removed from crates.io for malicious code GHSA-X468-PHR8-H3P3Criticaluniswap-utils: `uniswap-utils` was removed from crates.io for malicious code GHSA-3MMG-7C2Q-8938Criticalsha-rust: `sha-rust` was removed from crates.io for malicious code GHSA-F8H5-X737-X4XRCriticalfinch-rust: `finch-rust` was removed from crates.io for malicious code GHSA-382Q-FPQH-29F7Criticalpolymarket-clients-sdk: `polymarket-clients-sdk` was removed from crates.io for malicious code GHSA-6662-54XR-8423Criticalevm-units: `evm-units` was removed from crates.io for malicious code GHSA-GCQF-3G44-VC9PMediumactix-files: [actix-files] Panic triggered by empty Range header in GET request for static file GHSA-8V2V-WJWG-VX6RMediumactix-files: actix-files has a possible exposure of information vulnerability CVE-2026-25628Highqdrant: qdrant has arbitrary file write via `/logger` endpoint CVE-2026-25727Mediumtime: time vulnerable to stack exhaustion Denial of Service attack GHSA-J39J-6GW9-JW6HLowgit2: git2 has potential undefined behavior when dereferencing Buf struct GHSA-8X3W-QJ7J-GQHFHighopenmls: openmls has improper tag validation CVE-2026-25541Mediumbytes: bytes has integer overflow in BytesMut::reserve CVE-2026-25537Mediumjsonwebtoken: jsonwebtoken has Type Confusion that leads to potential authorization bypass CVE-2026-24762Mediumrustfs: RustFS Logs Sensitive Credentials in Plaintext CVE-2026-21862Highrustfs: RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers GHSA-H37V-HP6W-2PP8Mediumml-dsa: ml-dsa's UseHint function has off by two error when r0 equals zero CVE-2026-24889Mediumsoroban-sdk: soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo