Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-X77X-7MMH-CXV3Mediumncurses: ncurses exposes uninitialized memory in string reading functions GHSA-XCPM-76HF-C9CCLowborrowck_sacrifices: Borrowck Scarifices exposes uninitialized memory in any_as_u8_slice GHSA-FP5X-7M4Q-449FLowdirect_ring_buffer: Direct Ring Buffer has uninitialized memory exposure in create_ring_buffer GHSA-H5J3-CRG5-8JQMLoworx-pinned-vec: orx-pinned-vec has undefined behavior in index_of_ptr with empty slices CVE-2025-62518Highastral-tokio-tar: astral-tokio-tar Vulnerable to PAX Header Desynchronization CVE-2025-62370Highalloy-dyn-abi: alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing GHSA-6FGX-X7M2-74QMLowtracexec: tracexec has `env` command argument injection via environment variables starting with dash in traced exec events CVE-2025-11695Highmongodb: MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string CVE-2025-62162Highcel: cel-rust May Panic During Parsing of Invalid CEL Expressions CVE-2025-61787Highdeno: Deno is Vulnerable to Command Injection on Windows During Batch File Execution CVE-2025-61786Lowdeno: Deno's --deny-read check does not prevent permission bypass GHSA-2PGJ-5CV2-6XXWHighfuel-vm: FuelVM is vulnerable to heap memory allocation re-use bug CVE-2025-61785Lowdeno: Deno's --deny-write check does not prevent permission bypass GHSA-466C-PFVV-V83GLowwrflib: wrflib has a soundness issue and is unmaintained CVE-2025-61588Criticalrisc0-zkvm-platform: risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`GHSA-QR9H-X63W-VQFMMediumopenmls: OpenMLS improper persistence of the secret tree during message processing CVE-2025-59825Mediumastral-tokio-tar: astral-tokio-tar has a path traversal in tar extraction GHSA-MM7X-QFJJ-5G2CLowammonia: Ammonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal GHSA-393W-9X6H-8GC7Highpingora-core: Pingora update for MadeYouReset HTTP/2 vulnerability GHSA-CVMJ-47V9-35M9Highfuser: FUSE-Rust: Uninitalized memory read and leak caused by fuser crate GHSA-HHW4-XG65-FP2XMediumserde_yml: serde_yml crate is unsound and unmaintained GHSA-GFXP-F68G-8X78Highlibyml: LibYML: `libyml::string::yaml_string_extend` is unsound and unmaintained GHSA-95HM-PR6Q-298WHighfast-able: fast-able is vulnerable to DoS attack through insecure method CVE-2025-59058Mediumhttpsig: httpsig-rs: HMAC verification is vulnerable to timing attack CVE-2025-11060MediumSurrealDB: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.