Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-32032Highapollo-router: Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass GHSA-794X-2RPG-RFGRMediumjj-lib: Jujutsu does not have SHA-1 collision detection GHSA-4FCV-W3QC-PPGGMediumopenssl: rust-openssl Use-After-Free in `Md::fetch` and `Cipher::fetch`CVE-2025-31130Mediumgix-features: gitoxide does not detect SHA-1 collision attacks CVE-2025-31477Criticaltauri-plugin-shell: Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`GHSA-PPH8-GCV7-4QJ5Lowpyo3: PyO3 Risk of buffer overflow in `PyString::from_object`CVE-2024-13941Mediumouch: Ouch Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability GHSA-67R5-RQWV-9P9QLowarray-init-cursor: array-init-cursor is unsound when used with types that implement `Drop`GHSA-J8X2-777P-23FCLowtough: tough cyclic delegation graphs are not detected CVE-2025-2886Mediumtough: tough terminating targets role delegations are not respected CVE-2025-2885Mediumtough: tough root metadata version is not checked for sequential versioning CVE-2025-2888Mediumtough: tough timestamp metadata is cached when it fails snapshot rollback check CVE-2025-2887Mediumtough: tough failure to detect delegated target rollback GHSA-9CC5-2PQ7-HFJ8Mediumxmas-elf: xmas-elf potential out-of-bounds read with a malformed ELF file and the HashTable API.GHSA-FC83-9JWQ-GC2MMediumweb-push: Web Push Denial of Service via malicious Web Push endpoint GHSA-VGMH-MQM4-8J88Mediumpared: pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints CVE-2025-30160Highredlib: Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form CVE-2025-27612Mediumlibcontainer: Libcontainer is affected by capabilities elevation similar to GHSA-f3fp-gc8g-vw66 CVE-2025-25500Mediumcosmwasm: CosmWasm Allows Bypass of Capability Restrictions in Blockchains CVE-2025-29787Highzip: zip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write CVE-2025-27512Lowzincati: Zincati allows unprivileged access to rpm-ostree D-Bus `Deploy()` and `FinalizeDeployment()` methods CVE-2025-30089Mediumgurk: gurk (aka gurk-rs) mishandles ANSI escape sequences CVE-2025-27591Highbelow: Below has Incorrect Permission Assignment for Critical Resource GHSA-FMWF-C46W-R8QMMediumqcp: qcp has possible crash/DOS in some build configurations CVE-2025-53605Mediumprotobuf: Crash due to uncontrolled recursion in protobuf crate

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.