Loading...

Sign in Get Started

Browse CVEs by Ecosystem and Severity

626 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.

All ecosystems npm pypi packagist maven go crates.io rubygems nuget

All severities critical high medium low KEV only

Clear all filters

RustFS: Missing Post Policy Validation leads to Arbitrary Object Write

Wasmtime can panic when adding excessive fields to a `wasi:http/types.fields` instance

Wasmtime WASI implementations are vulnerable to guest-controlled resource exhaustion

Wasmtime is vulnerable to panic when dropping a `[Typed]Func::call_async` future

Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_process

Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass

The rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide

SurrealDB vulnerable to Denial of Service through scripting function memory edge case

Panic in `libcrux-psq` on decryption of malformed AES-GCM ciphertext

qdrant has arbitrary file write via `/logger` endpoint

RUSTSEC-2026-0071

Nonce Reuse in HPKE Context

bytes has integer overflow in BytesMut::reserve

RustFS has SourceIp bypass via spoofed X-Forwarded-For/Real-IP headers

Clatter has a PSK Validity Rule Violation issue

soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives

GHSA-5w5r-mf82-595p

Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema

dcap-qvl has Missing Verification for QE Identity

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions

Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass

Deno node:crypto doesn't finalize cipher

RustCrypto Utilities cmov: `thumbv6m-none-eabi` compiler emits non-constant time assembly when using `cmovnz`

RustCrypto: Signatures has timing side-channel in ML-DSA decomposition

RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE

SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()

SM2-PKE has 32-bit Biased Nonce Vulnerability

Salvo is vulnerable to reflected XSS in the list_html function

Salvo is vulnerable to stored XSS in the list_html function by uploading files with malicious names

RustFS has IAM deny_only Short-Circuit that Allows Privilege Escalation via Service Account Minting

RustFS has IAM Incorrect Authorization in ImportIam that Allows Privilege Escalation

RustFS Path Traversal Vulnerability

gix-date can create non-utf8 string with `TimeBuf::as_str`

theshit vulnerable to unsafe loading of user-owned Python rules when running as root

RustFS has a gRPC Hardcoded Token Authentication Bypass

sd changes the group ownership of the source file

Critical Use-After-Free in Wasmi's Linear Memory

GHSA-2cgv-28vr-rv6j

libcrux incorrectly calculates on aarch64

GHSA-2fjw-whxm-9v4q

libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)

cggmp24 and cggmp21 are vulnerable to signature forgery through altered presignatures

cggmp21 has a missing check in the ZK proof used in CGGMP21

thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS

Apollo Router Affected by an Access Control Bypass on Polymorphic Types

Apollo Router Improperly Enforces Renamed Access Control Directives

youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects

youki container escape via "masked path" abuse due to mount race conditions

GHSA-wwxp-hxh6-8gf8

binary_vec_io access memory out-of-bounds in binary_read_to_ref and binary_write_from_ref

astral-tokio-tar Vulnerable to PAX Header Desynchronization

alloy-dyn-abi has DoS vulnerability on `alloy_dyn_abi::TypedData` hashing

MongoDB Rust Driver has certificate validation disabled when `tlsInsecure=False` appears in connection string

cel-rust May Panic During Parsing of Invalid CEL Expressions

Deno is Vulnerable to Command Injection on Windows During Batch File Execution

Scan your dependencies for these CVEs