Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-6V2J-VR4H-F632Criticalfinch_cli_rust: `finch_cli_rust` was removed from crates.io for malicious code GHSA-XP79-9MXW-878JCriticalfinch-rst: `finch-rst` was removed from crates.io for malicious code GHSA-X468-PHR8-H3P3Criticaluniswap-utils: `uniswap-utils` was removed from crates.io for malicious code GHSA-3MMG-7C2Q-8938Criticalsha-rust: `sha-rust` was removed from crates.io for malicious code GHSA-F8H5-X737-X4XRCriticalfinch-rust: `finch-rust` was removed from crates.io for malicious code GHSA-382Q-FPQH-29F7Criticalpolymarket-clients-sdk: `polymarket-clients-sdk` was removed from crates.io for malicious code GHSA-6662-54XR-8423Criticalevm-units: `evm-units` was removed from crates.io for malicious code GHSA-GCQF-3G44-VC9PMediumactix-files: [actix-files] Panic triggered by empty Range header in GET request for static file GHSA-8V2V-WJWG-VX6RMediumactix-files: actix-files has a possible exposure of information vulnerability CVE-2026-25628Highqdrant: qdrant has arbitrary file write via `/logger` endpoint CVE-2026-25727Mediumtime: time vulnerable to stack exhaustion Denial of Service attack GHSA-J39J-6GW9-JW6HLowgit2: git2 has potential undefined behavior when dereferencing Buf struct GHSA-8X3W-QJ7J-GQHFHighopenmls: openmls has improper tag validation CVE-2026-25541Mediumbytes: bytes has integer overflow in BytesMut::reserve CVE-2026-25537Mediumjsonwebtoken: jsonwebtoken has Type Confusion that leads to potential authorization bypass CVE-2026-24762Mediumrustfs: RustFS Logs Sensitive Credentials in Plaintext CVE-2026-21862Highrustfs: RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers GHSA-H37V-HP6W-2PP8Mediumml-dsa: ml-dsa's UseHint function has off by two error when r0 equals zero CVE-2026-24889Mediumsoroban-sdk: soroban-sdk has overflow in Bytes::slice, Vec::slice, GenRange::gen_range for u64 CVE-2026-24850Mediumml-dsa: ML-DSA Signature Verification Accepts Signatures with Repeated Hint Indices CVE-2026-24785Highclatter: Clatter has a PSK Validity Rule Violation issue CVE-2026-24783Highsoroban-fixed-point-math: soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives GHSA-5W5R-MF82-595PCriticalcapnp: Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema GHSA-RVR2-R3PV-5M4PHighoneshot: oneshot has potential Use After Free when used asynchronously CVE-2026-24116Mediumwasmtime: Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.