Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-59047Lowmatrix-sdk-base: matrix-sdk-base: Panic in the `RoomMember::normalized_power_level()` method GHSA-PFP7-VXGR-83PWHightoodee: toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor CVE-2025-58359Mediumfrost-core: frost-core: refresh shares with smaller min_signers will reduce security of group GHSA-XQJR-WFX3-GMXVMediumarray-queue: ArrayQueue's push_front is not panic-safe GHSA-3632-54Q8-M96XHigharenavec: arenavec has multiple memory corruption vulnerabilities in safe APIs CVE-2025-58160Lowtracing-subscriber: Tracing logging user input may result in poisoning logs with ANSI escape sequences GHSA-9Q78-27F3-2JMHMediumwebp: webp crate may expose memory contents when encoding an image CVE-2025-58066Mediumntpd-rs: DoS Vulnerability in ntpd-rs GHSA-655H-HG88-5QMFLowxcb: Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety GHSA-QQ4C-HM99-979MMediumid-map: IdMap from_iter may lead to uninitialized memory being freed on drop GHSA-77H3-W9RX-HJ3QMediumscratchpad: User-defined implementations of the safe trait scratchpad::Tracking can cause heap buffer overflows CVE-2025-54867Highyouki: Youki: If /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem.CVE-2025-55159Mediumslab: slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check CVE-2025-7054Highquiche: quiche connection ID retirement can trigger an infinite loop CVE-2025-54873Lowrisc0-zkvm: RISC Zero Underconstrained Vulnerability: Division CVE-2025-54804Mediumrussh: russh is missing overflow checks during channel windows adjust CVE-2025-54581Highvproxy: vproxy Divide by Zero DoS Vulnerability CVE-2025-8283Lownetavark: Netavark Has Possible DNS Resolve Confusion CVE-2025-53901Lowwasmtime-wasi: Wasmtime CLI is vulnerable to host panic through its fd_renumber function GHSA-7MCQ-F592-PF7VHighslice-deque: Slice Ring Buffer and Slice Deque contains four unique double-free vulnerabilities triggered through safe APIs GHSA-XRRQ-RRGQ-H89WLowstatic-alloc: static-alloc vulnerability leads to uninitialized read after allocating MemBump CVE-2025-53549Mediummatrix-sdk: Matrix Rust SDK vulnerable to SQL Injection through its EventCache implementation CVE-2025-53604Mediumweb-push: Rust Web Push is vulnerable to a DoS attack via a large integer in a Content-Length header CVE-2025-53359Mediumethereum: ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions CVE-2025-52884Lowrisc0-ethereum-contracts: RISC Zero Ethereum invalid commitment with digest value of zero accepted by Steel.validateCommitment

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.