Rust Cargo vulnerabilities
2 known vulnerabilities affecting rust/cargo.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2019-16760P3HIGHCVSS 7.5≥ 1.0.0, < 1.26.02019-09-30
CVE-2019-16760 [HIGH] CWE-16 CVE-2019-16760: Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `pac
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration key. Usage of the `package` key to rename dependencies in `Cargo.toml` is ignored in Rust 1.25.0 and prior. When Rust 1.25.0 and prior is used Cargo may download the wrong dependency, which could be squatted on crates.io to be a malic
ghsanvdosv
CVE-2026-5222P3MEDIUMCVSS 6.5≥ 1.68.0, < 1.96.02026-05-25
CVE-2026-5222 [MEDIUM] CWE-647 CVE-2026-5222: Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the spar
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severi
cvelistv5ghsanvd