Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-F85W-WVC7-CRWCMediumbumpalo: bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()`CVE-2023-22499Highdeno: Deno is vulnerable to race condition via interactive permission prompt spoofing CVE-2022-45299Criticalwebbrowser: webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL CVE-2022-46176Mediumcargo: Cargo did not verify SSH host keys CVE-2023-22895Highbzip2: bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow CVE-2023-22466Mediumtokio: Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe GHSA-GFGM-CHR3-X6PXMediumprettytable-rs: prettytable-rs: Force cast a &Vec<T> to &[T] may lead to undefined behavior GHSA-5WVV-Q5FV-2388Mediumhyper-staticfile: hyper-staticfile's location header incorporates user input, allowing open redirect CVE-2022-46171Mediumtauri: Tauri Filesystem Scope Glob Pattern is too Permissive CVE-2022-23507Mediumtendermint-light-client-verifier: Tendermint light client verification not taking into account chain ID CVE-2022-3996Highopenssl-src: Denial of service by double-checked locking in openssl-src CVE-2022-23523Lowlinux-loader: linux-loader reading beyond EOF could lead to infinite loop GHSA-9V25-R5Q2-2P6WMediummpl-candy-machine: Candy Machine Set Collection During Mint Missing Check GHSA-8R76-FR72-J32WHighmpl-bubblegum: Creator Verification Error when Bubblegum Activate GHSA-969W-Q74Q-9J8VMediumsecp256k1: Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code CVE-2022-23486Highlibp2p: libp2p DoS vulnerability from lack of resource management GHSA-7P7C-PVVX-2VX3Mediumhyper-staticfile: hyper-staticfile's improper validation of Windows paths could lead to directory traversal attack CVE-2022-46149Mediumcapnp: Cap'n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list CVE-2022-39397Mediumaliyun-oss-client: Leak in Aliyun KeySecret CVE-2022-39393Highwasmtime: Wasmtime may have data leakage between instances in the pooling allocator CVE-2022-39392Mediumwasmtime: Wasmtime out of bounds read/write with zero-memory-pages configuration GHSA-5M39-WX2Q-MXG3Mediumlzf: Invalid use of `mem::uninitialized` causes `use-of-uninitialized-value`CVE-2022-41874LowTauri: Tauri Filesystem Scope can be Partially Bypassed GHSA-MCMR-49X3-4JQMHighckb: ckb type_id script resume may randomly fail GHSA-7FW6-6MFJ-G3Q2Criticalckb: ckb: Transaction header_deps validation issue (network forking)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.