Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-GG76-HG3V-5Q6CHighmacroquad: macroquad vulnerable to multiple soundness issues CVE-2025-46718Lowsudo-rs: sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others CVE-2025-46717Lowsudo-rs: sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders CVE-2025-47736Lowlibsql-sqlite3-parser: libsql-sqlite3-parser crash due to invalid UTF-8 input CVE-2025-47737Lowtrailer: trailer mishandles allocating with a size of zero CVE-2025-47735Lowwgp: wgp race condition in inner::drop GHSA-4H96-MV53-2C86Mediumfast_id_map: fast_id_map has a soundness issue and is unmaintained GHSA-79M9-55JC-P6MWLowscanner: scanner has a Public API without sufficient bounds checking GHSA-QV97-5QR8-2266Mediummithril-client: Mithril snapshots for Cardano database could be compromised by an adversary GHSA-58XC-HPVQ-8473Lowredox_uefi_std: Redox UEFI Safe API can cause heap-buffer-overflow GHSA-M2XR-2VJ4-WH94Mediumtanton_engine: tanton_engine has unsound public API CVE-2025-46723Highopenvm: OpenVM allows the byte decomposition of pc in AUIPC chip to overflow CVE-2024-58253Lowobfstr: obfstr Type Confusion vulnerability GHSA-927Q-G9W9-PM54Mediummp3-metadata: Panic in mp3-metadata due to the lack of bounds checking CVE-2025-32439Mediumpleezer: Pleezer resource exhaustion through uncollected hook script processes GHSA-5Q9X-554G-9JGGMediumsurrealdb: SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)GHSA-PXW4-94J3-V9PFHighsurrealdb: SurrealDB CPU exhaustion via custom functions result in total DoS GHSA-3824-QMFQ-2QV7Lowsurrealdb: SurrealDB no JavaScript script function default timeout could facilitate DoS GHSA-3633-G6MG-P6QQHighsurrealdb: SurrealDB memory exhaustion via string::replace using regex GHSA-CCJ3-5P93-8P42Criticalsurrealdb: SurrealDB server-takeover via SurrealQL injection on backup import GHSA-2CVJ-G5R5-JRRGLowsurrealdb: SurrealDB has local file read of 2-column TSV files via analyzers GHSA-M7RC-8W7M-R9QRMediumsurrealdb: SurrealDB vulnerable to memory exhaustion via nested functions and scripts GHSA-RQ86-9M6R-CM3GHighsurrealdb: SurrealDB has uncaught exception in Net module that leads to database crash CVE-2025-4574Mediumcrossbeam-channel: crossbeam-channel Vulnerable to Double Free on Drop GHSA-6JRF-4JV4-R9MWHightendermint-light-client-verifier: tendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo