Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-2VH6-HW4J-32WWMediumgix-packetline: gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)CVE-2026-54786Lowwasmtime-wasi: Wasmtime has a leak in WASIp1 `fd_renumber` implementationCVE-2026-55663Mediummediasoup: mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)GHSA-FX4F-MHW4-QM7JMediumvibeio-http: vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengthsGHSA-3GJW-F78C-VVPWMediumtokio-postgres: tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of serviceGHSA-RGQC-3X5P-6GWGMediumpostgres-protocol: postgres-protocol: Panic decoding a malformed `hstore` value allows denial of serviceGHSA-5X78-73V4-XG6WHighpostgres-protocol: postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of serviceGHSA-MC9M-6FM9-PGHCMediumzoo-kcl: Zoo Design Studio: Memory-corruption in memory handling of lib-kclGHSA-JGVR-6X5W-HX5WMediumzoo-kcl: Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-serviceGHSA-QWGH-2VCV-G2F7Mediumblock_buffer: block_buffer: panic corrupts inline buffer positionGHSA-VJF8-9FX6-MV6XMediumtriton-vm: Triton VM Soundness Vulnerability due to Missing ConstraintCVE-2026-10740Mediums2n-quic: s2n-quic has excessive memory allocationCVE-2026-63740Mediumsurrealdb: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record usersCVE-2026-46369Highnimiq-blockchain: nimiq-blockchain: Validity store off by one errorCVE-2026-68930Mediumrussh: Russh: Channel-scoped server callbacks can be reached without an open channelGHSA-3WHF-VGF2-9W6GMediumzaino-state: zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth LimitGHSA-6XX4-9WP6-65P7Mediumskilo: skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill sourceGHSA-HC4M-Q9JH-XW4JMediumnono-cli: nono-cli'scregistry pack verification can fail open when provenance metadata is absentCVE-2026-46428Criticallettre: lettre has TLS hostname verification disabled when using Boring TLS backendCVE-2026-16756Highaws-smithy-http-server: Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris…GHSA-2625-RW7M-5Q5XLowhubuum_client: Hubuum client library (Rust): Sensitive data may be exposed through default diagnosticsGHSA-QQC3-94QV-7FW3Mediumhubuum_client: Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network trafficGHSA-F45Q-W629-WR25Mediumhubuum_client: Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirectsCVE-2026-73429Mediumrussh: Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)CVE-2026-73489Mediumrussh: Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo