crates.io vulnerabilities
1,952 vulnerabilities and 21 malicious packages in crates.io. wasmtime has the most reviewed advisories.
Most exploited crates.io vulnerabilities
- CVE-2023-4863 Google Chromium WebP Heap-Based Buffer Overflow
- CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
- CVE-2026-46695 BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files
- CVE-2023-42454 SQLpage vulnerable to public exposure of database credentials
- CVE-2023-28445 Deno improperly handles resizable ArrayBuffer
- CVE-2023-26489 Guest-controlled out-of-bounds read/write on x86_64 in wasmtime
- CVE-2022-24783 Sandbox bypass leading to arbitrary code execution in Deno
- CVE-2026-115889 Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
- CVE-2026-115893 Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
- CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass
- CVE-2024-55225 Vaultwarden vulnerable to user impersonation
- CVE-2024-3584 Path Traversal in qdrant/qdrant
crates.io packages with the most advisories
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.