Ecosystem
crates.io
2,075 known vulnerabilities.
Most affected packages
196 results · Clear filters · Feed
-
Critical —
`time_calibrator` was removed from crates.io due to malicious code
It was reported `time_calibrator` contained malicious code, that would try to upload `.env` files to a server. The malicious crate had only 1 version published at 2026-02-28 and no evidence of actual usage. The crate was removed from crates.io and the user ac…
-
Critical —
`tracing-check` was removed from crates.io for malicious code
This is part of an ongoing campaign to attempt to typosquat crates in the [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) ecosystem to exfiltrate user credentials. The malicious crate had 1 version published on 2026-02-24 approximate…
-
Critical 9.1
Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover
RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.83, a Stored Cross-Site Scripting (XSS) vulnerability in the RustFS Console allows an attacker to execute arbitrary JavaScript in the context of the management console. …
-
Critical —
`polymarket-client-sdks` was removed from crates.io for malicious code
It appeared to be typosquatting existing crate [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) (`sdks` vs `sdk`) and attempting to steal credentials from local files. The malicious crate had 1 version published on 2026-02-09 and had …
-
Critical —
`sha-rst` was removed from crates.io for malicious code
This crate was used as a dependency by `finch_cli_rust` and `finch-rst` and contained a malware payload to exfiltrate credentials. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 22 times. Other than the other crates above th…
-
Critical —
`finch_cli_rust` was removed from crates.io for malicious code
This attempts to typosquat the existing crate [`finch_cli`](https://crates.io/crates/finch_cli) to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 18 times. There were no crates depending o…
-
Critical —
`finch-rst` was removed from crates.io for malicious code
This attempts to typosquat the existing crate [`finch`](https://crates.io/crates/finch) to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 21 times. There were no crates depending on this c…
-
Critical —
`uniswap-utils` was removed from crates.io for malicious code
It depended on the `evm-units` crate, which appeared to be attempting to steal cryptocurrency.
-
Critical —
`sha-rust` was removed from crates.io for malicious code
It appeared to be attempting to steal credentials from local files.
-
Critical —
`finch-rust` was removed from crates.io for malicious code
It depended on the `sha-rust` crate, which appeared to be attempting to steal credentials from local files.
-
Critical —
`polymarket-clients-sdk` was removed from crates.io for malicious code
It appeared to be typosquatting existing crate [`polymarket-client-sdk`](https://crates.io/crates/polymarket-client-sdk) (`clients` vs `client`) and attempting to steal credentials from local files. The malicious crate had 6 versions published on 2026-02-05 a…
-
Critical —
`evm-units` was removed from crates.io for malicious code
It appeared to be attempting to steal cryptocurrency.
-
Critical —
Cap'n Proto has Undefined Behavior in constant::Reader and StructSchema
The safe API functions `constant::Reader::get` and `StructSchema::new` rely on `PointerReader::get_root_unchecked`, which can cause undefined behavior (UB) by constructing arbitrary words or schemas. ## `Reader::get` ```rust pub fn get(&self) -> Result<<T as …
-
Critical 9.3
dcap-qvl has Missing Verification for QE Identity
dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Id…
-
Critical 9.2
Deno node:crypto doesn't finalize cipher
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The vulnerability allows an attacker to have infinite encryptions. This can lead to naive attempts at brute forcing, as well as more refined attacks …
-
Critical 9.8
RustFS has a gRPC Hardcoded Token Authentication Bypass
RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both cli…
-
Critical —
libnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)
A heap-buffer-overflow vulnerability exists in the Rust wrapper for libnftnl, triggered via the nftnl::Batch::with_page_size constructor. When a small or malformed page size is provided, the underlying C code allocates an insufficient buffer, leading to out-o…
-
Critical 9.3
CGGMP24 is missing a check in the ZK proof used in CGGMP21
CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing (requires 3 preprocessing rounds), identifiable abort, and a key refresh protocol. Prior to version 0.6.3, there is a missing check in the ZK proof that enables an attack in which sing…
-
Critical 9.3
risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`
RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to writ…
-
Critical 9.8
IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library
A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library. Versions of IO::Compress::Brotli prior to 0.007 included a version of the brotli library prior to version 1.0.8, where an attacker controlling the input length of a "one…
-
Critical 9.3
Improper Scope Validation in the open Endpoint of tauri-plugin-shell
The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system op…
-
Critical —
Namada-apps allows Excessive Computation in Mempool Validation
### Impact A malicious transaction may cause an expensive computation in mempool validation. A transaction with multiple repeated sections causes the section hash calculation used for signature validation to grow exponentially (and potentially even cubic) in …
-
Critical —
Namada-apps can Crash with Excessive Computation in Mempool Validation
### Impact A malicious transaction may cause a crash in mempool validation. A transaction with authorization section containing 256 public keys or more with valid matching signatures triggers an integer overflow in signature verification that causes a the nod…
-
Critical —
Namada-apps allows Post-Genesis Validator Bypass
### Impact Ledger crash. A user is able to initialize a post-genesis validator with a negative commission rate using the `--force` flag. If this validator gets into the consensus set, then when computing PoS inflation inside `fn update_rewards_products_and_mi…
-
Critical 9.3
Critical vulnerability in `ismp-grandpa` <v15.0.1
Hyperbridge is a hyper-scalable coprocessor for verifiable, cross-chain interoperability. A critical vulnerability was discovered in the ismp-grandpa crate, that allowed a malicious prover easily convince the verifier of the finality of arbitrary headers. Thi…
-
Critical 9.8
Vaultwarden vulnerable to user impersonation
An issue in the component src/api/identity.rs of Vaultwarden prior to v1.32.5 allows attackers to impersonate users, including Administrators, via a crafted authorization request.
-
Critical 9.6
Vaultwarden HTML injection vulnerability
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
-
Critical 9.3
Path traversal via crafted Git repositories in jj
jj, or Jujutsu, is a Git-compatible VCS written in rust. In affected versions specially crafted Git repositories can cause `jj` to write files outside the clone. This issue has been addressed in version 0.23.0. Users are advised to upgrade. Users unable to up…
-
Critical 9.1
Heap-based Buffer Overflow in sqlite-vec
sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
-
Critical 9.4
nano-id is unable to generate the correct character set
nano-id is a unique string ID generator for Rust. Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the `nano_id::base62` and `nano_id::base58` functions. Specifically, the `base62` function used a character set…
-
Critical 9.8
Path Traversal in qdrant/qdrant
qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the `/collections/{name}/snapshots/upload` endpoint. By manipulating the `name` parameter through URL encoding, an attacker can upload a file to an arbitrary l…
-
Critical 9.1
Spin contains a potential network sandbox escape for specifically configured Spin applications
Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to ar…
-
Critical 9.1
Defect in query plan cache may cause incorrect operations to be executed in Apollo Router
Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed w…
-
Critical 9.8
aliyundrive-webdav vulnerable to Command Injection
An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid parameter in the action_query_qrcode component.
-
Critical —
Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result
### Impact Tx-pool verify transaction which inputs' script contains `load_cell_data_hash` is nondeterministic ### Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none.
-
Critical —
Nervos CKB P2P DoS Attacks
The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted `tx_hashes`, it will mark it in memory to avoid duplicated requests. [code → ](https://github.com/nervosnetwork/ckb/blob/26e4837212c392c3c706a0da7a056131f…
-
Critical 10.0
SQLpage vulnerable to public exposure of database credentials
SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the `sqlpage/sqlpage.json` configuration file (not in an environment variable), wi…
-
Critical 9.3
Possible path traversal when storing RRDP responses
NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of respons…
-
Critical 10.0
Deno improperly handles resizable ArrayBuffer
Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this h…
-
Critical 10.0
Guest-controlled out-of-bounds read/write on x86_64 in wasmtime
wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined…