Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-21620Highdeno_fetch: fetch: Authorization headers not dropped when redirecting cross-originGHSA-GMX7-GR5Q-85W5Lowmagic-crypt: magic-crypt uses insecure cryptographic algorithmsGHSA-GV7F-5QQH-VXFXLowxous: xous has unsound usages of `core::slice::from_raw_parts` GHSA-HQMP-G7PH-X543Mediumquincy: TunnelVision - decloaking VPNs using DHCPGHSA-WRW7-89JP-8Q8GMediumglib: Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`GHSA-H6XM-C6R4-VMWFMediumspl-token-swap: Unsound usages of `u8` type casting in spl-token-swapGHSA-F7QJ-V3VP-4856Mediumlibafl: libafl has unsound usages of `core::slice::from_raw_parts_mut` GHSA-3QX8-RV27-J6GPMediumkvm-ioctls: Undefined behaviour in `kvm_ioctls::ioctls::vm::VmFd::create_device`GHSA-4FG7-VXC8-QX5WMediumrage: rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary executionGHSA-2FF4-XFPR-M32RMediumhd-wallet: `Slip10Like` derivation method instantiated with certain curves may allow attacker to find derivation path which results into very long…CVE-2024-58356Lowsurrealdb: SurrealDB has Silent Failure to Overwrite Table Definition of Relation TypeGHSA-753P-WRJ5-G8FJHighpqcrypto-hqc: PQClean has a correctness error in HQC decapsulationGHSA-2Q97-M5RC-P3GPMediumgithub.com/CosmWasm/wasmvm/v2: CosmWasm VM Incorrect meteringGHSA-VMQH-5232-V43RMediumgithub.com/CosmWasm/wasmvm/v2: Panic in wasmvm can slow down block productionCVE-2024-12224Mediumidna: `idna` accepts Punycode labels that do not produce any non-ASCII when decodedGHSA-VXCF-C7MX-PG53Mediumpyo3: Build corruption when using `PYO3_CONFIG_FILE` environment variableGHSA-GW5W-5J7F-JMJJLowpprof: Unsound usages of `std::slice::from_raw_parts` CVE-2024-53857Highpgp: rPGP Potential Resource Exhaustion when handling Untrusted MessagesCVE-2024-53856Highpgp: rPGP Panics on Malformed Untrusted InputGHSA-FWFX-RRV8-CRPFMediumrustyscript: op_panic in the base runtime can force a panic in the runtime's containing threadGHSA-4MW5-2636-4535Mediumjs-sandbox: op_panic in the base runtime can force a panic in the runtime's containing threadGHSA-2RXC-GJRP-VJHXMediumanstream: Unsoundness in anstreamGHSA-WWQ9-3CPR-MM53Highhashbrown: Borsh serialization of HashMap is non-canonicalGHSA-F95P-4CV5-8W8XLowlinkme: linkme fails to ensure slice elements match the slice's declared typeGHSA-X3F4-45XF-RJM7Mediumruzstd: `ruzstd` uninit and out-of-bounds memory reads

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo