Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-4GG8-GXPX-9RPHMediumuv: uv is vulnerable to arbitrary file write through entry point names GHSA-3PV8-6F4R-FFG2Mediumtar: tar has a PAX header desynchronization issue GHSA-3CV2-H65G-FGMMMediumastral-tokio-tar: astral-tokio-tar has a PAX Header Desynchronization issue CVE-2026-46690Mediumunbounded-spsc: unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race CVE-2026-47144Mediumshamefile: Shamefile has an arbitrary file read via shamefile.yaml in shame next CVE-2026-47128Mediumnono-cli: nono: Sandbox escape on Linux via D-Bus: `systemd-run --user`CVE-2026-44726Highdeno: Deno's TLS retry copies stale upgrade hook, risking plaintext traffic CVE-2026-46703Criticalboxlite: Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host CVE-2026-46695Criticalboxlite: BoxLite: Permission Bypass Allows Modification of Read-Only Files CVE-2026-46671Mediumonenote_parser: Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files outside the notebook directory CVE-2026-46673Highrussh-cryptovec: Russh: Unchecked CryptoVec allocation and growth handling is reachable CVE-2026-46654Highp3-challenger: Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss CVE-2026-46545Highnimiq-primitives: nimiq-primitives: Panic DoS in trie chunk processing via ROOT-keyed item CVE-2026-46543Mediumnimiq-blockchain: nimiq-blockchain: Genesis batch set request CVE-2026-46542Mediumnimiq-keys: nimiq-keys: Denial of service in Ed25519 multisig delinearization via invalid curve points CVE-2026-46539Mediumnimiq-primitives: nimiq-primitives: BlockInclusionProof interlink issue when hops are empty CVE-2026-45792Mediumrtk: RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM CVE-2026-45784Mediumopenssl: rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers GHSA-M9P2-FXP5-V3FPMediumdiesel: Diesel: Command injection in Diesel's implementation of `COPY FROM`/`COPY TO`GHSA-Q8X8-JRHJ-FH9PMediumdiesel: Diesel: Possible unaligned data access for implementations of `SqliteAggregate`GHSA-FHVH-VW7H-9XF3Highlibcrux-ml-dsa: libcrux-ml-dsa: Signature Verification on AVX2 Platforms Mishandles Edge Case GHSA-HC3C-63HC-2R9FHighlibcrux-chacha20poly1305: libcrux: Potential Panic on Overlong Ciphertext Buffer GHSA-FVH2-GM75-J4J7Highdynoxide-rs: dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport GHSA-VFVV-C25P-M7MMMediumrkyv: rkyv: Panic safety bugs in `InlineVec::clear` and `SerVec::clear` enable arbitrary code execution CVE-2026-40092Highnimiq-keys: nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.