Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-857Q-XMPH-P2V5Mediums2n-tls: s2n-tls's mTLS API ordering may skip client authentication GHSA-RG2Q-2JH9-447QMediumcosmwasm-vm: Gas mispricing in cosmwasm-vm CVE-2024-41949Lowbiscuit-auth: biscuit-auth vulnerable to public key confusion in third party block CVE-2024-41815Highstarship: Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands GHSA-66FW-43H8-F8P3Lowxmp_toolkit: XMP Toolkit's `XmpFile::close` can trigger undefined behavior GHSA-CX7H-H87R-JPGRLowgix-attributes: The kstring integration in gix-attributes is unsound CVE-2024-41178Mediumobject_store: Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files GHSA-Q445-7M23-QRMWMediumopenssl: openssl's `MemBio::get_buf` has undefined behavior with empty buffers CVE-2024-40648Mediummatrix-sdk-crypto: matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check CVE-2024-40644Highgix-path: gix-path can use a fake program files location CVE-2024-40640Mediumvodozemac: vodozemac's usage of non-constant time base64 decoder could lead to leakage of secret key material GHSA-5XGJ-PMJJ-GW49Lowrisc0-zkvm: RISC Zero zkVM notes on zero-knowledge GHSA-GH9F-6XM2-C4J2Mediumsurrealdb: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User CVE-2024-39697Criticalphonenumber: panic on parsing crafted phonenumber inputs GHSA-74R5-G7VC-J2V2Mediumzerovec-derive: zerovec-derive incorrectly uses `#[repr(packed)]`GHSA-XRV3-JMCP-374JMediumzerovec: zerovec incorrectly uses `#[repr(packed)]`CVE-2024-6382Mediummongodb: MongoDB Rust driver may issue unintended commands CVE-2024-38528Highntpd: Unlimited number of NTS-KE connections can crash ntpd-rs server CVE-2024-58261Lowsequoia-openpgp: Low severity (DoS) vulnerability in sequoia-openpgp CVE-2024-58262Lowcurve25519-dalek: curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`CVE-2024-36760Highrhai: Rhai stack overflow vulenrability CVE-2024-38358Lowwasmer: Symlink bypasses filesystem sandbox GHSA-52XF-5P2M-9WRVLows2n-tls: s2n-tls has a potentially observable differences in RSA premaster secret handling CVE-2024-36400Criticalnano-id: Unable to generate the correct character set CVE-2024-3584Criticalqdrant: qdrant is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.