Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-7MCQ-F592-PF7VHighslice-deque: Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs GHSA-XRRQ-RRGQ-H89WLowstatic-alloc: static-alloc vulnerability leads to uninitialized read after allocating MemBump CVE-2025-53549Mediummatrix-sdk: Matrix Rust SDK vulnerable to SQL Injection through its EventCache implementation CVE-2025-53604Mediumweb-push: Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header CVE-2025-53359Mediumethereum: ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions CVE-2025-52884Lowrisc0-ethereum-contracts: RISC Zero Ethereum invalid commitment with digest value of zero accepted by Steel.validateCommitment CVE-2025-52570Mediumletmeind: letmein connection limiter allows an arbitrary amount of simultaneous connections CVE-2025-52926Lowspytrap-adb: spytrap-adb Omission of Security-relevant Information CVE-2025-52484Lowrisc0-zkvm: zkVM Underconstrained Vulnerability CVE-2025-4366Highpingora-core: Pingora has a Request Smuggling Vulnerability GHSA-9GHP-W2HM-VFPFMediumwasmtime-jit-debug: wasmtime_jit_debug Dumps Undefined Memory by `JitDumpFile`GHSA-V33J-V3X4-42QGMediumhurl: Regex literal in Hurl files are not escaped when exported to HTML, allowing injections CVE-2025-48937Mediummatrix-sdk-crypto: matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator CVE-2024-21486Mediumdeno: Deno vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-5791Highusers: users may append `root` to group listings GHSA-PR59-JJR4-GCF6Lowanon-vec: anon-vec lacks sufficient checks in public API CVE-2025-48935Mediumdeno: Deno has --allow-read / --allow-write permission bypass in `node:sqlite`CVE-2025-48934Mediumdeno: Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables CVE-2025-48888Mediumdeno: Deno run with --allow-read and --deny-read flags results in allowed CVE-2025-24015Highdeno: Deno's AES GCM authentication tags are not verified GHSA-WV8J-M3HX-924JHigharrow2: Arrow2 allows out of bounds access in public safe API CVE-2025-48756Lowscsir: SCSIR has a Potential Unsound Issue in WriteSameCommand CVE-2025-48751Lowprocess_lock: process_lock has a Potential Unsound issue in unlock CVE-2025-48754Lowmemory_pages: memory_pages division by zero CVE-2025-48752Lowprocess-sync: Process Sync has a Potential Unsound Issue in SharedMutex

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.