Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-52736Highzebra-state: Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache GHSA-H72H-PPCX-998PLowzebra-network: Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length CVE-2026-52732Mediumzebrad: zebrad has mempool transaction admission denial via single-peer inbound queue saturation GHSA-C8W6-X74F-VMG3Mediumzebra-rpc: zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers GHSA-443G-GWGP-49X4Lowzebrad: zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length CVE-2026-52731Mediumzebra-rpc: zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate CVE-2026-50185Mediumcmov: Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set CVE-2026-49997Mediumsurrealdb: SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted CVE-2026-63761Mediumsurrealdb: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation GHSA-C8JX-96C9-8XRPMediumsurrealdb: SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths GHSA-WP87-MGVQ-5J93Mediumsurrealdb: SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization CVE-2026-63743Mediumsurrealdb: SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect GHSA-6WQW-VHFR-9999Mediumsurrealdb: SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions GHSA-F82J-V89J-MF86Mediumsurrealdb: SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission CVE-2026-63751Mediumsurrealdb: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`CVE-2026-63748Mediumsurrealdb: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages GHSA-4M82-P8CX-F94JMediumsurrealdb: SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls GHSA-65RJ-R9FH-JP2VMediumsurrealdb: SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket frames CVE-2026-63758Mediumsurrealdb: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries GHSA-4V76-CW68-4VC9Mediumsurrealdb: SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table required GHSA-6VG3-HGRW-P5GFMediumsurrealdb: SurrealDB has an Authorization Bypass via Composite Record-id Paths CVE-2026-63746Mediumsurrealdb: SurrealDB: Graph traversal bypasses table SELECT permissions CVE-2026-63755Mediumsurrealdb: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level GHSA-Q8QP-67F9-WR3FMediumsurrealdb: SurrealDB vulnerable to Denial of Service due to nested types annotations GHSA-WJJJ-24CX-F28GHighsurrealdb: SurrealDB has unauthenticated remote DoS via malformed RPC `use` call

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo