Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: rust-lang Component: Cargo Clear all filters
TI-2026-04563 CVE-2026-5223 · GHSA-jq42-7mfv-hm57

Crates in third party registries can override the cached source of other crates

Priority LOW 29

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00294 Published 2026-05-25 Partial fix · 1.96.0, 0.97.0 CWE-61
TI-2026-04562 CVE-2026-5222 · GHSA-p688-r7jv-fm6f

Cargo can be coerced to share credentials between registries

Priority LOW 13

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00478 Published 2026-05-25 Fixed in 1.96.0, 0.97.0 CWE-647
TI-2022-22820 CVE-2022-46176 · GHSA-r5w3-xm58-jv6j

Cargo did not verify SSH host keys

Priority LOW 28

Cargo is a Rust package manager.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00679 Published 2023-01-11 Fixed in 0.67.1 CWE-347