Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-HFF2-GCPX-8F4PMediumapollo-router: Apollo Router Core: Browser Bug Enables Bypass of XS-Search Prevention via Read-Only Cross-Site Request Forgery GHSA-CP57-FQ8G-QH6VHighlibcrux-ml-dsa: libcrux has an Incorrect Check of Signer Response Norm During Verification GHSA-PV9V-5J35-XWCRHighlibcrux-poly1305: libcrux Panics During Standalone MAC Operations GHSA-Q29P-9PFR-J652Highlibcrux-sha3: libcrux-sha3: Incorrect output from SHAKE squeeze functions GHSA-434V-X5QV-PMH6Highlibcrux-ed25519: libcrux has All-Zero Key Generation Upon Catastrophic RNG Failure GHSA-XRF2-5R3P-5WGJHighlibcrux-ml-dsa: libcrux: Panic in Signature Hint Decoding During Verification CVE-2026-33693Mediumactivitypub_federation: Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()GHSA-PWJX-QHCG-RVJ4Mediumrustls-webpki: webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic GHSA-9F94-5G5W-GF6RHighaws-lc-fips-sys: CRL Distribution Point Scope Check Logic Error in AWS-LC GHSA-394X-VWMW-CRM3Highaws-lc-sys: AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CN CVE-2026-33056Mediumtar: tar-rs `unpack_in` can chmod arbitrary directories by following symlinks CVE-2026-33055Mediumtar: tar-rs incorrectly ignores PAX size headers if header size is nonzero CVE-2026-33241Highsalvo: Salvo Affected by Denial of Service via Unbounded Memory Allocation in Form Data Parsing CVE-2026-33242Highsalvo: Salvo has a Path Traversal in salvo-proxy::encode_url_path allows API Gateway Bypass CVE-2026-33040Highlibp2p-gossipsub: Gossipsub PRUNE.backoff Duration Overflow CVE-2026-32766Mediumastral-tokio-tar: astral-tokio-tar insufficiently validates PAX extensions during extraction CVE-2026-32829Highlz4_flex: lz4_flex's decompression can leak information from uninitialized memory or reused output buffer CVE-2026-32314Highyamux: Yamux vulnerable to remote Panic via malformed Data frame with SYN set and len = 262145 CVE-2026-32260Highdeno: Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process CVE-2026-32322Mediumsoroban-sdk: rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction CVE-2026-31814Highyamux: Yamux vulnerable to remote Panic via malformed WindowUpdate credit CVE-2026-32129Highsoroban-poseidon: Poseidon V1 variable-length input collision via implicit zero-padding GHSA-4CM8-XPFV-JV6FMediumzeptoclaw: ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation CVE-2026-32232Highzeptoclaw: ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink CVE-2026-32231Highzeptoclaw: ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.