Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-4H96-MV53-2C86Mediumfast_id_map: fast_id_map has a soundness issue and is unmaintained GHSA-79M9-55JC-P6MWLowscanner: scanner has a Public API without sufficient bounds checking GHSA-QV97-5QR8-2266Mediummithril-client: Mithril snapshots for Cardano database could be compromised by an adversary GHSA-58XC-HPVQ-8473Lowredox_uefi_std: Redox UEFI Safe API can cause heap-buffer-overflow GHSA-M2XR-2VJ4-WH94Mediumtanton_engine: tanton_engine has unsound public API CVE-2025-46723Highopenvm: OpenVM allows the byte decomposition of pc in AUIPC chip to overflow CVE-2024-58253Lowobfstr: obfstr Type Confusion vulnerability GHSA-927Q-G9W9-PM54Mediummp3-metadata: Panic in mp3-metadata due to the lack of bounds checking CVE-2025-32439Mediumpleezer: Pleezer resource exhaustion through uncollected hook script processes CVE-2025-71398Mediumsurrealdb: SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)GHSA-PXW4-94J3-V9PFHighsurrealdb: SurrealDB CPU exhaustion via custom functions result in total DoS GHSA-3824-QMFQ-2QV7Lowsurrealdb: SurrealDB no JavaScript script function default timeout could facilitate DoS GHSA-3633-G6MG-P6QQHighsurrealdb: SurrealDB memory exhaustion via string::replace using regex CVE-2025-71392Criticalsurrealdb: SurrealDB server-takeover via SurrealQL injection on backup import GHSA-2CVJ-G5R5-JRRGLowsurrealdb: SurrealDB has local file read of 2-column TSV files via analyzers GHSA-M7RC-8W7M-R9QRMediumsurrealdb: SurrealDB vulnerable to memory exhaustion via nested functions and scripts GHSA-RQ86-9M6R-CM3GHighsurrealdb: SurrealDB has uncaught exception in Net module that leads to database crash CVE-2025-4574Mediumcrossbeam-channel: crossbeam-channel Vulnerable to Double Free on Drop GHSA-6JRF-4JV4-R9MWHightendermint-light-client-verifier: tendermint-rs's Light Client Verifier allows malicious validators to spoof votes from other validators GHSA-WR2M-38XH-RPC9Mediumlemmy_server: Lemmy user purging users or communities or banning users can delete images they didn't upload/exclusively use GHSA-RR8G-9FPQ-6WMGLowtokio: Tokio broadcast channel calls clone in parallel, but does not require `Sync`CVE-2025-31496Highapollo-compiler: Apollo Compiler Named Fragment Processing Vulnerability CVE-2025-32380Highapollo-router: Apollo Router Query Validation Vulnerable to Excessive Resource Consumption via Named Fragment Processing CVE-2025-32033Highapollo-router: Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflow CVE-2025-32034Highapollo-router: Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo