# crates.io


- [CVE-2023-4863](https://insights.sbomify.com/CVE-2023-4863/): Google Chromium WebP Heap-Based Buffer Overflow (high 8.8, exploited in the wild)
- [CVE-2026-115905](https://insights.sbomify.com/CVE-2026-115905/): zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE (critical 10.0)
- [CVE-2026-46695](https://insights.sbomify.com/CVE-2026-46695/): BoxLite: Permission Bypass in boxlite Allows Modification of Read-Only Files (critical 10.0)
- [CVE-2023-42454](https://insights.sbomify.com/CVE-2023-42454/): SQLpage vulnerable to public exposure of database credentials (critical 10.0)
- [CVE-2023-28445](https://insights.sbomify.com/CVE-2023-28445/): Deno improperly handles resizable ArrayBuffer (critical 10.0)
- [CVE-2023-26489](https://insights.sbomify.com/CVE-2023-26489/): Guest-controlled out-of-bounds read/write on x86_64 in wasmtime (critical 10.0)
- [CVE-2022-24783](https://insights.sbomify.com/CVE-2022-24783/): Sandbox bypass leading to arbitrary code execution in Deno (critical 10.0)
- [CVE-2026-115889](https://insights.sbomify.com/CVE-2026-115889/): Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation (critical 9.9)
- [CVE-2026-115893](https://insights.sbomify.com/CVE-2026-115893/): Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction (critical 9.9)
- [CVE-2025-68926](https://insights.sbomify.com/CVE-2025-68926/): RustFS has a gRPC Hardcoded Token Authentication Bypass (critical 9.8)
- [CVE-2024-55225](https://insights.sbomify.com/CVE-2024-55225/): Vaultwarden vulnerable to user impersonation (critical 9.8)
- [CVE-2024-3584](https://insights.sbomify.com/CVE-2024-3584/): Path Traversal in qdrant/qdrant (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/ecosystems/crates.io/