Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-111061Mediumrussh: russh: Unbounded memory allocation in agent protocol server via crafted constraint records CVE-2026-111062Lowrussh: A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request CVE-2026-58494Mediumwasmtime-wasi: Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination GHSA-6FJ4-RCR3-R7RRHighlopdf: lopdf has a stack overflow via deeply nested PDF objects CVE-2026-103929Highmise: mise permits untrusted local configuration to override default shell arguments CVE-2026-104843Mediumuv: uv: Path traversal on Windows through wheel extraction GHSA-2MJX-QC3C-RQVCMediumrustls: Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries GHSA-6F2X-V7Q7-M7M5Mediumhickory-resolver: hickory-resolver follows irrelevant CNAME records GHSA-6W6G-HM98-MHGMHighhickory-resolver: hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)GHSA-5J98-2G5X-46V6Highhickory-resolver: hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures GHSA-CJCG-CXMH-9WCRHighpraxis-proxy: Praxis affected by HTTP/2 Bomb CVE-2026-104855Lowwasmtime: Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state CVE-2026-18140Highaws-smithy-json: aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in…GHSA-6G2R-675J-HX59Lowxxhash-rust: xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release GHSA-C9XM-49CP-XCR9Mediumrmcp: rmcp OAuth client fetches server-controlled resource_metadata URLs CVE-2026-102820Mediumpageant: pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)CVE-2026-102821Mediumrussh: Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey CVE-2026-102822Lowrussh: russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic CVE-2026-102823Highrussh: russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened CVE-2026-102824Mediumrussh: Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange CVE-2026-102825Lowrussh: Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path CVE-2026-102342Mediumammonia: Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')GHSA-2JX3-FF3V-J7JJMediumyara-x: yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB CVE-2026-61670Mediummicrosandbox: microsandbox: Secret values exposed in world-readable process arguments CVE-2026-68537Highfulgur: Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.