crates.io records
1,199 published records for vendor crates.io.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 6
- With a fix record
- 37.2%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-125 Out-of-bounds Read15
- CWE-20 Improper Input Validation12
- CWE-416 Use After Free10
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer10
- CWE-770 Allocation of Resources Without Limits or Throttling9
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor8
The weakness classes this vendor ships most often: where to look.
CWEAll records
1,199 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | GHSA-5wp8-q9mx-8jx8No exploit | zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcardscrates.io · zeptoclaw · CWE-77 | Critical10.0 | — | — | Mar 5, 2026 |
39Monitor | GHSA-3jch-9qgp-4844No exploit | Generated code can read and write out of bounds in safe codecrates.io · flatbuffers | Critical9.8 | — | — | Jun 16, 2022 |
39Monitor | RUSTSEC-2021-0122No exploit | Generated code can read and write out of bounds in safe codecrates.io · flatbuffers | Critical9.8 | — | — | Oct 31, 2021 |
39Monitor | GHSA-x4mq-m75f-mx8mNo exploit | Delegate functions are missing `Send` boundcrates.io · windows · CWE-820 | Critical9.8 | — | — | Jun 17, 2022 |
39Monitor | GHSA-9q5j-jm53-v7vrNo exploit | lz4-sys vulnerable to memory corruption via issue in liblz4crates.io · lz4-sys · CWE-190 | Critical9.8 | — | — | Sep 1, 2022 |
39Monitor | RUSTSEC-2022-0051No exploit | Memory corruption in liblz4crates.io · lz4-sys | Critical9.8 | — | — | Aug 25, 2022 |
35Monitor | GHSA-5qfp-32cf-69jhNo exploit | SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callerscrates.io · surrealdb · CWE-384 | High8.8 | — | — | Jul 1, 2026 |
34Monitor | GHSA-22q8-ghmq-63vfNo exploit | libgit2-sys affected by memory corruption, denial of service, and arbitrary code execution in libgit2crates.io · libgit2-sys | High8.6 | — | — | Feb 12, 2024 |
34Monitor | RUSTSEC-2024-0013No exploit | Memory corruption, denial of service, and arbitrary code execution in libgit2crates.io · libgit2-sys | High8.6 | — | — | Feb 6, 2024 |
32Monitor | GHSA-w5w5-8vfh-xcjqNo exploit | whoami stack buffer overflow on several Unix platformscrates.io · whoami · CWE-121 | High8.2 | — | — | Apr 5, 2024 |
32Monitor | GHSA-wq9x-qwcq-mmgfNo exploit | Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Castscrates.io · diesel · CWE-89 | High8.1 | — | — | Aug 23, 2024 |
32Monitor | GHSA-4vgr-h27g-cf9pNo exploit | SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalationcrates.io · surrealdb · CWE-362 | High8.1 | — | — | Jul 1, 2026 |
30Monitor | GHSA-hhjv-jq77-cmvxNo exploit | zeptoclaw has Android device shell blocklist bypass via argument permutationcrates.io · zeptoclaw · CWE-78 | High7.5 | — | — | Mar 5, 2026 |
30Monitor | GHSA-xq3c-8gqm-v648No exploit | async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflowcrates.io · async-graphql | High7.5 | — | — | Jul 29, 2022 |
30Monitor | GHSA-xfhw-6mc4-mgxfNo exploit | crayon: ObjectPool creates uninitialized memory when freeing objectscrates.io · crayon · CWE-908 | High7.5 | — | — | Apr 5, 2024 |
30Monitor | GHSA-w7hm-hmxv-pvhfNo exploit | HPACK decoder panics on invalid inputcrates.io · hpack · CWE-754 | High7.5 | — | — | Apr 5, 2024 |
30Monitor | GHSA-58j9-j2fj-v8f4No exploit | SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interfacecrates.io · surrealdb | High7.5 | — | — | Jan 19, 2024 |
30Monitor | GHSA-cc8f-fcx3-gpjrNo exploit | SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filtercrates.io · surrealdb · CWE-209 | High7.7 | — | — | Jun 19, 2026 |
30Monitor | GHSA-fpf5-4jw8-67x8No exploit | rust-zserio has Unbounded Memory Allocationcrates.io · rust-zserio · CWE-789 | High7.5 | — | — | May 7, 2026 |
30Monitor | GHSA-wjjj-24cx-f28gNo exploit | SurrealDB has unauthenticated remote DoS via malformed RPC `use` callcrates.io · surrealdb · CWE-248 | High7.5 | — | — | Jul 1, 2026 |
30Monitor | GHSA-8qv2-5vq6-g2g7No exploit | webpki: CPU denial of service in certificate path buildingcrates.io · webpki · CWE-400 | High7.5 | — | — | Aug 25, 2023 |
30Monitor | GHSA-fh2r-99q2-6mmgNo exploit | rustls-webpki: CPU denial of service in certificate path buildingcrates.io · rustls-webpki · CWE-400 | High7.5 | — | — | Aug 22, 2023 |
30Monitor | GHSA-4v52-7q2x-v4xjNo exploit | eyre: Parts of Report are dropped as the wrong type during downcastcrates.io · eyre · CWE-843 | High7.5 | — | — | Apr 5, 2024 |
30Monitor | GHSA-m3wp-48jr-vr4gNo exploit | mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoScrates.io · mistralrs-server-core · CWE-400 | High7.5 | — | — | Sep 10, 2026 |
30Monitor | RUSTSEC-2022-0037No exploit | Denial of service on deeply nested fragment requestscrates.io · async-graphql | High7.5 | — | — | Jul 21, 2022 |
- GHSA-5wp8-q9mx-8jx840Plan
zeptoclaw has Shell allowlist-blocklist bypass via command/argument injection and file name wildcards
CriticalCVSS 10.0No exploitcrates.io · zeptoclawMar 5, 2026
- GHSA-3jch-9qgp-484439Monitor
Generated code can read and write out of bounds in safe code
CriticalCVSS 9.8No exploitcrates.io · flatbuffersJun 16, 2022
- RUSTSEC-2021-012239Monitor
Generated code can read and write out of bounds in safe code
CriticalCVSS 9.8No exploitcrates.io · flatbuffersOct 31, 2021
- GHSA-x4mq-m75f-mx8m39Monitor
Delegate functions are missing `Send` bound
CriticalCVSS 9.8No exploitcrates.io · windowsJun 17, 2022
- GHSA-9q5j-jm53-v7vr39Monitor
lz4-sys vulnerable to memory corruption via issue in liblz4
CriticalCVSS 9.8No exploitcrates.io · lz4-sysSep 1, 2022
- RUSTSEC-2022-005139Monitor
Memory corruption in liblz4
CriticalCVSS 9.8No exploitcrates.io · lz4-sysAug 25, 2022
- GHSA-5qfp-32cf-69jh35Monitor
SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers
HighCVSS 8.8No exploitcrates.io · surrealdbJul 1, 2026
- GHSA-22q8-ghmq-63vf34Monitor
libgit2-sys affected by memory corruption, denial of service, and arbitrary code execution in libgit2
HighCVSS 8.6No exploitcrates.io · libgit2-sysFeb 12, 2024
- RUSTSEC-2024-001334Monitor
Memory corruption, denial of service, and arbitrary code execution in libgit2
HighCVSS 8.6No exploitcrates.io · libgit2-sysFeb 6, 2024
- GHSA-w5w5-8vfh-xcjq32Monitor
whoami stack buffer overflow on several Unix platforms
HighCVSS 8.2No exploitcrates.io · whoamiApr 5, 2024
- GHSA-wq9x-qwcq-mmgf32Monitor
Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts
HighCVSS 8.1No exploitcrates.io · dieselAug 23, 2024
- GHSA-4vgr-h27g-cf9p32Monitor
SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation
HighCVSS 8.1No exploitcrates.io · surrealdbJul 1, 2026
- GHSA-hhjv-jq77-cmvx30Monitor
zeptoclaw has Android device shell blocklist bypass via argument permutation
HighCVSS 7.5No exploitcrates.io · zeptoclawMar 5, 2026
- GHSA-xq3c-8gqm-v64830Monitor
async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflow
HighCVSS 7.5No exploitcrates.io · async-graphqlJul 29, 2022
- GHSA-xfhw-6mc4-mgxf30Monitor
crayon: ObjectPool creates uninitialized memory when freeing objects
HighCVSS 7.5No exploitcrates.io · crayonApr 5, 2024
- GHSA-w7hm-hmxv-pvhf30Monitor
HPACK decoder panics on invalid input
HighCVSS 7.5No exploitcrates.io · hpackApr 5, 2024
- GHSA-58j9-j2fj-v8f430Monitor
SurrealDB vulnerable to Uncontrolled CPU Consumption via WebSocket Interface
HighCVSS 7.5No exploitcrates.io · surrealdbJan 19, 2024
- GHSA-cc8f-fcx3-gpjr30Monitor
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter
HighCVSS 7.7No exploitcrates.io · surrealdbJun 19, 2026
- GHSA-fpf5-4jw8-67x830Monitor
rust-zserio has Unbounded Memory Allocation
HighCVSS 7.5No exploitcrates.io · rust-zserioMay 7, 2026
- GHSA-wjjj-24cx-f28g30Monitor
SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
HighCVSS 7.5No exploitcrates.io · surrealdbJul 1, 2026
- GHSA-8qv2-5vq6-g2g730Monitor
webpki: CPU denial of service in certificate path building
HighCVSS 7.5No exploitcrates.io · webpkiAug 25, 2023
- GHSA-fh2r-99q2-6mmg30Monitor
rustls-webpki: CPU denial of service in certificate path building
HighCVSS 7.5No exploitcrates.io · rustls-webpkiAug 22, 2023
- GHSA-4v52-7q2x-v4xj30Monitor
eyre: Parts of Report are dropped as the wrong type during downcast
HighCVSS 7.5No exploitcrates.io · eyreApr 5, 2024
- GHSA-m3wp-48jr-vr4g30Monitor
mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS
HighCVSS 7.5No exploitcrates.io · mistralrs-server-coreSep 10, 2026
- RUSTSEC-2022-003730Monitor
Denial of service on deeply nested fragment requests
HighCVSS 7.5No exploitcrates.io · async-graphqlJul 21, 2022