Cargo vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-63760Highsurrealdb: SurrealDB has Denial of Service in JSON parser due to nested objectsGHSA-4VGR-H27G-CF9PHighsurrealdb: SurrealDB: HTTP RPC Session Race Condition Allows Privilege EscalationGHSA-5QFP-32CF-69JHHighsurrealdb: SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callersCVE-2026-5223Mediumcargo: Cargo crates in third party registries can override the cached source of other cratesCVE-2026-5222Lowcargo: Cargo can be coerced to share credentials between registriesCVE-2026-48504Mediumopentelemetry_sdk: opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagationGHSA-FQ3W-P4FG-MW73Lowfixurjavainstall: fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`CVE-2026-55448Mediummise: Mise's local credential_command executes untrusted configCVE-2026-55441Highmise: Mise vulnerable to arbitrary command execution via task-include files in an untrusted, config-less repositoryCVE-2026-54557Mediummise: mise HTTP backend uses raw version path for install symlink destinationGHSA-74P7-6H78-GW8PHighskillctl: skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgeryCVE-2026-33646Criticalmise: Mise Vulnerable to Arbitrary Code Execution via Tera Templates in .tool-versions Files (Trust Bypass)GHSA-JV2J-MQMW-XVV5Mediumsurrealdb: SurrealDB: Denial of Service via deep operator chainsCVE-2026-63738Mediumsurrealdb: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversalsGHSA-H4H3-3RFJ-X6FQMediumsurrealdb: SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted fieldGHSA-CC8F-FCX3-GPJRHighsurrealdb: SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filterGHSA-H5RG-8P7F-47G2Mediumsurrealdb: SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key FetchCVE-2026-11941Mediumquiche: Cloudflare Quiche: Use-after-free in connection ID iterator FFI functionsCVE-2026-55832Mediumtract-onnx: tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnxCVE-2026-55093Mediumtract-nnef: tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model loadCVE-2026-55517Mediumdeno: Deno: Denial of service via non-ASCII bytes in WebSocket response headersCVE-2026-49401Highdeno: Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)CVE-2026-49406Mediumdeno: Deno: BYONM module resolution allows `package.json` main path traversal to bypass `--allow-read` restrictionsCVE-2026-49411Mediumdeno: Deno: Node TCPWrap numeric hostname aliases bypass --deny-net resolved-IP deny checksCVE-2026-49440Highdeno: Deno: Miller-Rabin Primality Test Allows Zero Rounds

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo