crates.io CVE feed and alerts
Every new CVE and security advisory affecting crates.io packages, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.
- Critical
- 8
- High
- 33
- On CISA KEV
- 0
Of the newest 200
- RUSTSEC-2026-0529bsv-rs signature check bypass in KVStoreInterpreterbsv-rs
- RUSTSEC-2026-0501Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private keybsv-rs
- RUSTSEC-2026-0528Ref Swap use-after-free in swap types reachable from safe coderef-swap
- RUSTSEC-2026-0533ammonia cross-site scripting in HTML sanitizer via SVG and MathMLammonia
- RUSTSEC-2026-0497Transaction::from_json holds an input txid that is not 64 hex digits and writes the input as spending the zero txidbsv-rs
- RUSTSEC-2026-0499Signature::from_der reads a signature with bytes after it, a wrong sequence length or an unneeded zero as the signaturebsv-rs
- RUSTSEC-2026-0510Panic when decoding malformed Ed25519 keys from Base64vodozemac
- CVE-2026-42067Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow an…Intel(R) TDX Workload Attestation software · tdx_workload_a…
- CVE-2026-40693Improper input validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications may allow a denial of…Intel(R) TDX Workload Attestation software · tdx_workload_a…
- RUSTSEC-2026-0483`lwd-uri-util` was removed from crates.io for malicious codelwd-uri-util
- RUSTSEC-2026-0498Transaction readers accept trailing bytes, so a parsed transaction can carry another transaction idbsv-rs
- RUSTSEC-2026-0500BEEF validation answers valid for a raw entry that is not a transactionbsv-rs
- RUSTSEC-2026-0464`webhook_commands` was removed from crates.io for malicious codewebhook_commands
- RUSTSEC-2026-0465`electrumd` was removed from crates.io for malicious codeelectrumd
- RUSTSEC-2026-0469`env-test-guard` was removed from crates.io for malicious codeenv-test-guard
- RUSTSEC-2026-0470`gabby-types-sec` was removed from crates.io for malicious codegabby-types-sec
- CVE-2026-123613Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypassrustls
- CVE-2026-123612rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosurerustls
- CVE-2026-123611Rustls key exchange downgrade via ServerHello record poisoningrustls
- CVE-2026-123610rustls before 0.23.46 Denial of Service via Brotli Certificate Decompressionrustls
- CVE-2026-123609Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debugrustls
- CVE-2026-123608Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compressionhickory-dns · hickory-proto
- CVE-2026-123607Hickory DNS denial of service via loop in DNSSEC NSEC3 validationhickory-dns · hickory-net +1
- CVE-2026-123606Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplificationhickory-dns · hickory-recursor +1
- CVE-2026-123605Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Namehickory-dns · hickory-net
- CVE-2026-123604Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loophickory-dns · hickory-resolver
- CVE-2026-123601Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgeryhickory-dns · hickory-proto +1
- CVE-2026-123596Hickory DNS DNSSEC validation bypass in NSEC handlerhickory-dns · hickory-net +1
- CVE-2026-123595Hickory DNS DNSSEC validation bypass in NSEC3 handlinghickory-dns · hickory-net +1
- CVE-2026-123594Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminalshickory-dns · hickory-proto +1
- CVE-2026-123592Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collisionhickory-dns · hickory-net
- CVE-2026-123591Hickory DNS validation bypass in DNSSEC delegation handlinghickory-dns · hickory-proto +1
- CVE-2026-123587Hickory DNS authentication bypass in DNSSEC nonexistence validationhickory-dns · hickory-net
- CVE-2026-123586Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referralshickory-dns · hickory-resolver +1
- CVE-2026-123585Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Recordshickory-dns · hickory-resolver
- CVE-2026-123584Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responseshickory-dns · hickory-net
- CVE-2026-123581Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRsethickory-dns · hickory-proto +1
- CVE-2026-123580Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3hickory-dns · hickory-proto +1
- CVE-2026-123574Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parserhickory-dns · hickory-proto
- CVE-2026-123572Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parserhickory-dns · hickory-proto
- CVE-2026-123571Hickory DNS remote denial of service via panic in TSIG RDATA decodinghickory-dns · hickory-proto
- RUSTSEC-2026-0503eazip: symlink-target validation checks the wrong argument, allowing extraction path escapes on Windowseazip
- RUSTSEC-2026-0443Hidden file disclosure through Windows short namesactix-files
- RUSTSEC-2026-0445Degraded secret zeroization capabilitiesvodozemac
- RUSTSEC-2026-0446Request smuggling through malformed chunked request trailersactix-http
- RUSTSEC-2026-0447Compressed request bodies can exhaust memory before extractor limits applyactix-web
- RUSTSEC-2026-0448Unbounded decompression can exhaust memory and CPU resourcesactix-http
- RUSTSEC-2026-0451Degraded secret zeroization capabilitiesvodozemac
- RUSTSEC-2026-0455Large-window Brotli bodies bypass decompression memory limitsactix-http
- RUSTSEC-2026-0466`build_dep` was removed from crates.io for malicious codebuild_dep
Show all 200 entriesShow fewer entries
- RUSTSEC-2026-0467`top_level_crate` was removed from crates.io for malicious codetop_level_crate
- RUSTSEC-2026-0468`shinchina` was removed from crates.io for malicious codeshinchina
- RUSTSEC-2026-0471`sec-gemini` was removed from crates.io for malicious codesec-gemini
- RUSTSEC-2026-0472`shinchina-test` was removed from crates.io for malicious codeshinchina-test
- RUSTSEC-2026-0449`ocipkg` is unmaintainedocipkg
- RUSTSEC-2026-0462Unbounded response body buffering in Streamable HTTP clientsrmcp
- RUSTSEC-2026-0456Panic on an HEVC tile layout that does not match the active SPSheifer-hevc-dec
- RUSTSEC-2026-0458Memory exhaustion when parsing a crafted `iloc` boxheifer-isobmff
- RUSTSEC-2026-0460Panic on chroma QP offsets enabled with an empty offset listheifer-hevc-dec
- CVE-2026-121441Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smugglingbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-121440Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypassbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-121439Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-httpbytecodealliance wasmtime · wasmtime-wasi-http
- RUSTSEC-2026-0440`astral-tokio-tar` is unmaintainedastral-tokio-tar
- RUSTSEC-2026-0452Out-of-bounds read when decoding internal keys shorter than 16 bytessurrealkv
- RUSTSEC-2026-0454Data race and double free via unsound `Send`/`Sync` in `reblessive`surrealdb-core
- CVE-2026-111959Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds readsApache Software Foundation arrow · arrow-data
- RUSTSEC-2026-0430Path traversal in `rio-vt` Kitty graphics protocol handler allows out-of-bounds file delete (and read)rio-vt
- RUSTSEC-2026-0431Unbounded memory allocation in `evtx` parsing a `.wevtcache` fileevtx
- RUSTSEC-2026-0432`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)codeq
- RUSTSEC-2026-0434`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)ant-releases
- RUSTSEC-2026-0425`nix-nar`: `Decoder::unpack` writes archive entries outside the destination directory (path traversal)nix-nar
- RUSTSEC-2026-0426LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-timeorion
- RUSTSEC-2026-0428BLAKE2b produces wrong tag when using `reset()` with a different-length keyorion
- RUSTSEC-2026-0450`ocipkg`: unpacking an OCI archive can write and delete files outside the local image store (path traversal)ocipkg
- CVE-2026-119375SQLite before 3.54.0 Information Disclosure via WAL Page Size MismatchSQLite · libsqlite3-sys +1
- GHSA-C33X-VCV4-VG3GCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergencecedar-policy · @cedar-policy/cedar-wasm
- CVE-2026-119143Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via Zero-Length Stream Writesbytecodealliance wasmtime · wasmtime
- CVE-2026-119142Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via call_async Dropbytecodealliance wasmtime · wasmtime
- CVE-2026-119140Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via thread.yieldbytecodealliance wasmtime · wasmtime
- CVE-2026-119139Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via Func::callbytecodealliance wasmtime · wasmtime
- CVE-2026-119138Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic After Trapbytecodealliance wasmtime · wasmtime
- CVE-2026-119137Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Stack Overflow via Type Registrybytecodealliance wasmtime · wasmtime
- CVE-2026-119136Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Async-Entrypoint Enforcement Bypassbytecodealliance wasmtime · wasmtime
- CVE-2026-119135Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatchbytecodealliance wasmtime · wasmtime
- CVE-2026-119132Wasmtime 49.0.0 before 49.0.3 Host Panic via Overlapping String Transcode in Fused Adapterbytecodealliance wasmtime · wasmtime
- CVE-2026-119131Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-httpbytecodealliance wasmtime · wasmtime-wasi-http
- CVE-2026-119130Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smugglingbytecodealliance wasmtime · wasmtime-wasi-http
- RUSTSEC-2026-0419Unbounded memory use on large request bodiesjuniper_warp
- RUSTSEC-2026-0420wasip3 UDP `send` can deliver a datagram to an address only allowed for receivingwasmtime-wasi
- RUSTSEC-2026-0421wasi-http p2: outgoing content-length can be invalid or not match bodywasmtime-wasi-http
- RUSTSEC-2026-0422Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-checkwasmtime
- RUSTSEC-2026-0423Cross-engine type confusion with host-created struct-types-with-supertypeswasmtime
- RUSTSEC-2026-0424Unchecked memory usage in transferring borrowed resources between componentswasmtime
- RUSTSEC-2026-0427`sn-releases`: `extract_release_archive` writes archive entries without a path-traversal check (zip-slip)sn-releases
- CVE-2026-118688Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Renamebytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-116794russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationEugeny russh · russh
- RUSTSEC-2026-0415Unbounded memory use on large request bodiesjuniper_hyper
- RUSTSEC-2026-0416Stack overflow on deeply nested GraphQL documentsjuniper
- RUSTSEC-2026-0417Excessive CPU and memory use on crafted GraphQL documentsjuniper
- RUSTSEC-2026-0418libz-sys build script leaks environment variables in the build directorylibz-sys
- RUSTSEC-2026-0433Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`pulldown-cmark
- RUSTSEC-2026-0436Panic and unbounded allocation (OOM) in the CFB/OLE2 parser on malformed inputcalamine
- CVE-2026-116775pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)Eugeny russh · pageant
- CVE-2026-116774russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)Eugeny russh · russh
- CVE-2026-116773russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsEugeny russh · russh
- CVE-2026-116696russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesEugeny russh · russh
- RUSTSEC-2026-0486xattr functions mark unwritten bytes as initialized when given a zero-length bufferrustix
- CVE-2026-115909zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extractionzip-rs zip2 · zip
- CVE-2026-115908zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)zip-rs zip2 · zip
- CVE-2026-115907zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizezip-rs zip2 · zip
- CVE-2026-115906zip: AES Entry HMAC Authentication Bypass on Premature EOFzip-rs zip2 · zip
- CVE-2026-115905zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…zip-rs zip2 · zip
- RUSTSEC-2026-0412Arbitrary code execution when rerunning tests from a portable recordingcargo-nextest
- RUSTSEC-2026-0413Use-after-free of caller-owned server name in client connection constructorsrustls-ffi
- RUSTSEC-2026-0408Aliasing violations in splice, mutable iteration and cursorsskiplist
- RUSTSEC-2026-0409Use-after-free from a comparator that answers inconsistentlyskiplist
- GHSA-H4FR-CMH5-QR62Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootfallow · @fallow-cli/fallow-node +3
- CVE-2026-115893Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionbytecodealliance wasmtime · wasmtime
- CVE-2026-115892Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typebytecodealliance wasmtime · wasmtime
- CVE-2026-115889Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationbytecodealliance wasmtime · wasmtime
- CVE-2026-115569Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootfallow-rs fallow · @fallow-cli fallow-node +6
- CVE-2026-115567Tokio: Race condition in `tokio::time::Interval`tokio-rs tokio · tokio
- RUSTSEC-2026-0387Multiple timing variability issues in operations intended to be constant-timecrypto-bigint
- CVE-2026-115392Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashesbytecodealliance wasmtime · wasmtime
- CVE-2026-115391Wasmtime 46.0.0 before 46.0.3 and 47.0.0 before 47.0.4 Unbounded Heap Allocation via WASIp3 Streamsbytecodealliance wasmtime · wasmtime
- CVE-2026-115390Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 Fuel Accounting Bypass DoSbytecodealliance wasmtime · wasmtime
- CVE-2026-115389Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 Denial of Service via Val APIbytecodealliance wasmtime · wasmtime
- CVE-2026-115386Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Memory Disclosure via fd_readdirbytecodealliance wasmtime · wasmtime-wasi
- CVE-2026-115384Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflowbytecodealliance wasmtime · wasmtime
- CVE-2026-115383Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 GC Heap Corruption via Tag Importsbytecodealliance wasmtime · wasmtime
- CVE-2026-115381Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 Unbounded Host Memory Allocation via SinkOutputStream write-zeroesbytecodealliance wasmtime · wasmtime-wasi
- RUSTSEC-2026-0407SSRF and local file disclosure via unvalidated URLswebpage
- RUSTSEC-2026-0411Out-of-bounds read in `Log2Cache::nlog2n()`, `nlog2n_difference()` and `plog2p()`dahl-salso
- RUSTSEC-2026-0457OAuth client SSRF filter checks host strings, not resolved addressesrmcp
- CVE-2026-111943Distrust compromised intermediate certificates in crypto/x509Go standard library crypto/x509 · stdlib +3
- RUSTSEC-2026-0461Unbounded tool schema cache in Streamable HTTP server transportrmcp
- CVE-2026-105299Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deploymentshttps://github.com/cloudflare/pingora · pingora-proxy
- CVE-2026-105298Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypasshttps://github.com/cloudflare/pingora · pingora-core
- CVE-2026-105297Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limitshttps://github.com/cloudflare/pingora · pingora-core
- RUSTSEC-2026-0453Use-after-free in KV backends via leaked `affinitypool::spawn_local` futuresurrealdb
- RUSTSEC-2026-0534libp2p-gossipsub remote memory exhaustion via unbounded PRUNE backoff statelibp2p-gossipsub
- RUSTSEC-2026-0414Exponential event growth with `ENABLE_WIKILINKS`pulldown-cmark
- CVE-2026-95859rust-libp2p denial of service in Gossipsub via unbounded GRAFT topicsrust-libp2p · libp2p-gossipsub
- RUSTSEC-2026-0391Data from an abandoned stream leaks into the next stream on a reused contextzstd
- RUSTSEC-2026-0392Uninitialized memory exposed by `write::Decoder` on a corrupt legacy framezstd
- RUSTSEC-2026-0393Out-of-bounds read when training a dictionary from inconsistent sample sizeszstd
- RUSTSEC-2026-0395Use-after-free with `CParameter::StableInBuffer`zstd-safe
- RUSTSEC-2026-0396`Seekable` reads a NULL or out-of-bounds seek tablezstd-safe
- RUSTSEC-2026-0397`OutBuffer::around_pos` exposes uninitialized memoryzstd-safe
- RUSTSEC-2026-0398`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the endzstd-safe
- RUSTSEC-2026-0399Use-after-free through `init_using_cdict` and `init_using_ddict`zstd-safe
- RUSTSEC-2026-0400Use-after-free of a dictionary after a one-shot call on a context with an open streamzstd-safe
- RUSTSEC-2026-0401Out-of-bounds read in `train_from_buffer` when sample sizes overflowzstd-safe
- RUSTSEC-2026-0402Heap buffer overflow in `CCtx::try_clone` on a multithreaded contextzstd-safe
- RUSTSEC-2026-0403Uninitialized memory exposed when streaming decompression of a legacy frame failszstd-safe
- RUSTSEC-2026-0404Double free in `DCtx::try_clone`zstd-safe
- RUSTSEC-2026-0405Out-of-bounds read with an out-of-range `InBuffer::pos`zstd-safe
- RUSTSEC-2026-0406Use-after-free when changing a multithreaded context with an unfinished framezstd-safe
- RUSTSEC-2026-0410WebAssembly allocator shim corrupts memory on allocation failurezstd-sys
- RUSTSEC-2026-0356Panic on erroneous call-to-host from guest realloc callwasmtime
- RUSTSEC-2026-0363Component-model handle tables are capped only per instance and charged to no limitwasmtime
- RUSTSEC-2026-0364Exception tags can cause host data structures to be unalignedwasmtime
- RUSTSEC-2026-0444`astral-tl` is unmaintainedastral-tl
- GHSA-C9XM-49CP-XCR9rmcp OAuth client fetches server-controlled resource_metadata URLsrmcp
- RUSTSEC-2026-0441`pin-utils` is unmaintainedpin-utils
- RUSTSEC-2026-0523quinn-proto denial of service via crafted MAX_STREAM_DATA framequinn-proto
- RUSTSEC-2026-0524quinn-proto memory exhaustion and panic in QUIC client retry handlingquinn-proto
- RUSTSEC-2026-0538Quinn UDP denial of service in receive loop via oversized datagramquinn-udp
- RUSTSEC-2026-0394Build environment compiled into the library and readable at runtimerustpython-vm
- RUSTSEC-2026-0489Panic when an SVCB or HTTPS parameter value is a single quote characterhickory-proto
- RUSTSEC-2026-0491Memory amplification from record counts in the DNS message headerhickory-proto
- RUSTSEC-2026-0437Rejected authentication challenges can poison the Key Vault scope cacheazure_security_keyvault_certificates
- RUSTSEC-2026-0438Rejected authentication challenges can poison the Key Vault scope cacheazure_security_keyvault_secrets
- RUSTSEC-2026-0439Rejected authentication challenges can poison the Key Vault scope cacheazure_security_keyvault_keys
- RUSTSEC-2026-0482Paths or symlinks ending in a slash escape the sandboxcap-primitives
- GHSA-QWGH-2VCV-G2F7block_buffer: panic corrupts inline buffer positionblock_buffer
- CVE-2026-20765Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of…Intel(R) TDX Guest software · tdx-guest
- CVE-2026-20763Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation…Intel(R) TDX Guest software · tdx-guest
- CVE-2026-63759SurrealDB before 3.1.0 Denial of Service nested type annotationssurrealdb
- CVE-2026-63757SurrealDB before 3.1.0 Session Hijacking via /rpc sessionssurrealdb
- CVE-2026-63756SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Conditionsurrealdb
- CVE-2026-63754SurrealDB before 3.1.0 Denial of Service via LIVE Querysurrealdb
- CVE-2026-63753SurrealDB before 3.1.0 Authentication Bypass via LIVE Querysurrealdb
- CVE-2026-63752SurrealDB before 3.1.0 RELATE Statement Record Overwritesurrealdb
- CVE-2026-63750SurrealDB before 3.1.0 Memory Amplification via /sql WebSocketsurrealdb
- CVE-2026-63749SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECTsurrealdb
- CVE-2026-63747SurrealDB before 3.1.0 Denial of Service via malformed RPC usesurrealdb
- CVE-2026-63745SurrealDB before 3.1.0 Authorization Bypass via Composite Record-idsurrealdb
- CVE-2026-63744SurrealDB before 3.1.5 SSRF via JWKS URL Redirectsurrealdb
- CVE-2026-63742SurrealDB before 3.1.0 Field Permission Bypass via Indexed COUNTsurrealdb
- CVE-2026-63741SurrealDB before 3.1.0 Authentication Bypass via USE statementsurrealdb
- CVE-2026-63739SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZERsurrealdb
- CVE-2026-63737SurrealDB before 3.1.5 Denial of Service via deep operator chainssurrealdb
- CVE-2026-63309SurrealDB < 3.1.5 Information Disclosure via ORDER BYsurrealdb
- RUSTSEC-2026-0044AWS-LC X.509 Name Constraints Bypass via Wildcard/Unicode CNaws-lc-sys
- CVE-2026-2835HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsinghttps://github.com/cloudflare/pingora · pingora-core
- CVE-2023-0286X.400 address type confusion in X.509 GeneralNameOpenSSL · cryptography +1
- CVE-2021-3711SM2 Decryption Buffer OverflowOpenSSL · openssl-src
- CVE-2020-26235Segmentation fault in Rust time cratetime-rs time · time
- CVE-2020-8927Buffer overflow in Brotli libraryGoogle Brotli · brotli +122
Get alerts for new crates.io CVEs
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/feed?ecosystem=crates.io
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/feed?ecosystem=crates.io in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/feed?ecosystem=crates.io&format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/feed?ecosystem=crates.io&format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
Frequently asked questions
What are the latest crates.io packages CVEs?
The newest are RUSTSEC-2026-0529 (bsv-rs signature check bypass in KVStoreInterpreter); RUSTSEC-2026-0501 (Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private key); RUSTSEC-2026-0528 (Ref Swap use-after-free in swap types reachable from safe code).
Are any crates.io packages CVEs being exploited?
None of the 200 newest crates.io packages vulnerabilities are on CISA's Known Exploited Vulnerabilities list.
How many critical crates.io packages CVEs are there?
8 of the 200 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2026-111959, CVE-2026-115905, CVE-2026-115893, CVE-2026-115889, CVE-2026-115384 and more.
How do I get alerts for new crates.io packages CVEs?
Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.
Is there an RSS feed of crates.io CVEs?
Yes: https://cve.now/feed?ecosystem=crates.io. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.
How do I get crates.io CVEs in Slack or by email?
In Slack, run /feed subscribe https://cve.now/feed?ecosystem=crates.io. For email, give the RSS URL to any RSS-to-email service.