Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

113 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

Wasmtime has out-of-bounds write or crash when transcoding component model strings

Wasmtime has host panic when Winch compiler executes `table.fill`

Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on x86-64

Wasmtime has a possible panic when lifting `flags` component value

Wasmtime: Panic when transcoding misaligned utf-16 strings

Wasmtime: Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding

Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

tar-rs `unpack_in` can chmod arbitrary directories by following symlinks

tar-rs incorrectly ignores PAX size headers if header size is nonzero

rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction

Vaultwarden has 2FA Bypass on Protected Actions due to Faulty Rate Limit Enforcement

uv has ZIP payload obfuscation through parsing differentials

Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

SurrealDB vulnerable to Denial of Service through scripting function memory edge case

bytes has integer overflow in BytesMut::reserve

RustCrypto: Signatures has timing side-channel in ML-DSA decomposition

RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

gix-date can create non-utf8 string with `TimeBuf::as_str`

sd changes the group ownership of the source file

astral-tokio-tar has a path traversal in tar extraction

httpsig-rs: HMAC verification is vulnerable to timing attack

SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

frost-core: refresh shares with smaller min_signers will reduce security of group

russh is missing overflow checks during channel windows adjust

Matrix Rust SDK vulnerable to SQL Injection through its EventCache implementation

letmein connection limiter allows an arbitrary amount of simultaneous connections

Deno has --allow-read / --allow-write permission bypass in `node:sqlite`

Pleezer resource exhaustion through uncollected hook script processes

SurrealDB bypass of deny-net flags via redirect results in server-side request forgery (SSRF)

SurrealDB vulnerable to memory exhaustion via nested functions and scripts

gitoxide does not detect SHA-1 collision attacks

GHSA-vgmh-mqm4-8j88

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

CosmWasm Allows Bypass of Capability Restrictions in Blockchains

Crash due to uncontrolled recursion in protobuf crate

Some AES functions may panic when overflow checking is enabled in ring

Hickory DNS's DNSSEC validation may accept broken authentication chains

rustls network-reachable panic in `Acceptor::accept`

SurrealDB has an Uncaught Exception Sorting Tables by Random Order

SurrealDB has an Uncaught Exception in Function Generating Random Time

wasm3 uncontrolled memory allocation vulnerability

wasmtime has a runtime crash when combining tail calls with trapping imports

DOM clobbering could escalate to Cross-site Scripting (XSS)

Miniscript allows stack consumption

SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User

MongoDB Rust driver may issue unintended commands

gix refs and paths with reserved Windows device names access the devices

gix-transport indirect code execution via malicious username

Scan your dependencies for these CVEs