Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-22696Criticaldcap-qvl: dcap-qvl has Missing Verification for QE Identity CVE-2025-67124Mediumminiserve: miniserve affected by a TOCTOU and symlink race vulnerability GHSA-3V2X-9XCV-2V2VHighsurrealdb: SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions GHSA-RJR4-V43M-PXQ6Lowtriton-vm: Triton VM has a Soundness Vulnerability due to Improper Sampling of Randomness CVE-2026-22864Highdeno: Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass CVE-2026-22863Criticaldeno: Deno node:crypto doesn't finalize cipher CVE-2026-22782Lowrustfs: RustFS's RPC signature verification logs shared secret CVE-2026-23519Highcmov: RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`CVE-2026-22705Mediumml-dsa: RustCrypto: Signatures has timing side-channel in ML-DSA decomposition CVE-2026-22700Highsm2: RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE CVE-2025-15504Lowlief: LIEF is vulnerable to segmentation fault CVE-2026-22699Highsm2: SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()CVE-2026-22698Highsm2: SM2-PKE has 32-bit Biased Nonce Vulnerability GHSA-585Q-CM62-757JLowmnl: mnl has segmentation fault and invalid memory read in `mnl::cb_run`GHSA-G59M-GF8J-GJF5Lowaws-sdk-accessanalyzer: AWS SDK for Rust v1 adopted defense in depth enhancement for region parameter value CVE-2026-22256Highsalvo: Salvo is vulnerable to reflected XSS in the list_html function CVE-2026-22257Highsalvo: Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names CVE-2026-22043Mediumrustfs: RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting CVE-2026-22042Mediumrustfs: RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation GHSA-RHFX-M35P-FF5JLowlru: `IterMut` violates Stacked Borrows by invalidating internal pointer CVE-2025-69255Mediumrustfs: RustFS gRPC GetMetrics deserialization panic enables remote DoS CVE-2025-68705Highrustfs: RustFS Path Traversal Vulnerability CVE-2026-21895Lowrsa: rsa crate has potential panic on a prime being equal to 1 CVE-2026-0810Mediumgix-date: gix-date can create non-utf8 string with `TimeBuf::as_str`CVE-2025-69257Hightheshit: theshit vulnerable to unsafe loading of user-owned Python rules when running as root

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.