CVE Tools
Track your stack

Crates-io

1,273 CVEs across 72 months on the top 200 list since May 2016. Peak rank #4 in Dec 2020. 1 of them are now in CISA KEV.

Crates-io CVEs per month since May 2016

Sep 2021 to Aug 2026 in the lens. Point at a month to read it, or drag the frame to move through the record.Tallest in the lens: 61, Jun 2022
Sep 2021: 5 CVEs · 0 critical · 0 now in CISA KEV · rank #89 · mostly Wasmtime, Tremor-script, Pallet-ethereumOct 2021: 4 CVEs · 0 critical · 0 now in CISA KEV · rank #107 · mostly Tough, Evm, Pallet-ethereumNov 2021: 5 CVEs · 0 critical · 0 now in CISA KEV · rank #88 · mostly Routinator, Fruity, Lucet-runtimeDec 2021: 55 CVEs · 28 critical · 0 now in CISA KEV · rank #13 · mostly Rusqlite, Messagepack-rs, CkbJan 2022: 3 CVEs · 0 critical · 0 now in CISA KEV · rank #157 · mostly Bingrep, Pallet-evm-precompile-modexp, Solana_rbpfFeb 2022: 4 CVEs · 1 critical · 0 now in CISA KEV · rank #126 · mostly Crossbeam-utils, Galois_2p8, Parsec-serviceMar 2022: 7 CVEs · 1 critical · 0 now in CISA KEV · rank #82 · mostly Simple-wayland-hotkey-daemon, Deno, Openssl-srcApr 2022: 6 CVEs · 1 critical · 0 now in CISA KEV · rank #101 · mostly Simple-wayland-hotkey-daemon, Ckb, AfireMay 2022: 6 CVEs · 1 critical · 0 now in CISA KEV · rank #94 · mostly Openssl-src, Solana_rbpf, Totp-rsJun 2022: 61 CVEs · 1 critical · 0 now in CISA KEV · rank #12 · mostly Arrow, Rulex, CrossbeamJul 2022: 7 CVEs · 1 critical · 0 now in CISA KEV · rank #82 · mostly Openssl-src, Cranelift-codegen, WasmtimeAug 2022: 19 CVEs · 0 critical · 0 now in CISA KEV · rank #40 · mostly Apache-avro, Oqs, OpcuaSep 2022: 19 CVEs · 0 critical · 0 now in CISA KEV · rank #44 · mostly Axum-core, Cargo, LZ4-SYSOct 2022: 5 CVEs · 0 critical · 0 now in CISA KEV · rank #114 · mostly Evm, Conduit-hyper, Matrix-sdkNov 2022: 12 CVEs · 0 critical · 0 now in CISA KEV · rank #64 · mostly Ckb, Wasmtime, Openssl-srcDec 2022: 11 CVEs · 0 critical · 0 now in CISA KEV · rank #57 · mostly Hyper-staticfile, LIBP2P, Linux-loaderJan 2023: 9 CVEs · 1 critical · 0 now in CISA KEV · rank #63 · mostly Bumpalo, BZIP2, CargoFeb 2023: 18 CVEs · 0 critical · 0 now in CISA KEV · rank #42 · mostly Openssl-src, Ckb, DenoMar 2023: not on the top 200 that monthApr 2023: 7 CVEs · 0 critical · 0 now in CISA KEV · rank #92 · mostly Aws-sigv4, Borsh, Enumflags2May 2023: 4 CVEs · 0 critical · 0 now in CISA KEV · rank #158 · mostly Deno, Deno_runtime, MicrobinJun 2023: 11 CVEs · 0 critical · 0 now in CISA KEV · rank #56 · mostly Atty, Cyfs-base, Git-url-parseJul 2023: 5 CVEs · 0 critical · 0 now in CISA KEV · rank #128 · mostly S2N-QUIC, Intaglio, Lmdb-rsAug 2023: 10 CVEs · 0 critical · 0 now in CISA KEV · rank #84 · mostly Cargo, Lol-html, Mail-internalsSep 2023: 17 CVEs · 2 critical · 1 now in CISA KEV · rank #47 · mostly Inventory, Phonenumber, RoutinatorOct 2023: 4 CVEs · 0 critical · 0 now in CISA KEV · rank #184 · mostly Apollo-router, Pleaser, Stellar-strkeyNov 2023: 6 CVEs · 0 critical · 0 now in CISA KEV · rank #117 · mostly Rsa, Self_cell, OpenSSLDec 2023: 11 CVEs · 0 critical · 0 now in CISA KEV · rank #66 · mostly Zerocopy, Candid, PubnubJan 2024: 17 CVEs · 0 critical · 0 now in CISA KEV · rank #52 · mostly Surrealdb, Anoncreds-clsignatures, UrsaFeb 2024: 18 CVEs · 0 critical · 0 now in CISA KEV · rank #44 · mostly Ckb, Surrealdb, SvixMar 2024: 15 CVEs · 1 critical · 0 now in CISA KEV · rank #49 · mostly Deno, Quiche, EzaApr 2024: 9 CVEs · 0 critical · 0 now in CISA KEV · rank #92 · mostly Crayon, Eyre, GitoxideMay 2024: 14 CVEs · 2 critical · 0 now in CISA KEV · rank #85 · mostly Gix, Arti, Gix-indexJun 2024: 6 CVEs · 1 critical · 0 now in CISA KEV · rank #110 · mostly Nano-id, Ntpd, RhaiJul 2024: 14 CVEs · 0 critical · 0 now in CISA KEV · rank #53 · mostly Gix-attributes, Gix-path, Matrix-sdk-cryptoAug 2024: 14 CVEs · 0 critical · 0 now in CISA KEV · rank #56 · mostly Apollo-router, Cosmwasm-vm, Boa_engineSep 2024: 11 CVEs · 0 critical · 0 now in CISA KEV · rank #63 · mostly Gix-path, Lexical-core, Olm-sysOct 2024: 12 CVEs · 0 critical · 0 now in CISA KEV · rank #53 · mostly PYO3, Cocoon, SurrealdbNov 2024: 21 CVEs · 1 critical · 0 now in CISA KEV · rank #47 · mostly Surrealdb-core, Surrealdb, MimallocDec 2024: 23 CVEs · 0 critical · 0 now in CISA KEV · rank #30 · mostly Cosmwasm-vm, Pgp, AgeJan 2025: 11 CVEs · 2 critical · 0 now in CISA KEV · rank #67 · mostly Vaultwarden, Deno_fetch, Fast-floatFeb 2025: 13 CVEs · 0 critical · 0 now in CISA KEV · rank #60 · mostly Namada-apps, Hickory-proto, Orml-rewardsMar 2025: 18 CVEs · 0 critical · 0 now in CISA KEV · rank #53 · mostly Tough, Cosmwasm, Array-init-cursorApr 2025: 24 CVEs · 1 critical · 0 now in CISA KEV · rank #36 · mostly Surrealdb, Apollo-router, Gix-configMay 2025: 25 CVEs · 1 critical · 0 now in CISA KEV · rank #40 · mostly Sudo-rs, Pingora-core, Crossbeam-channelJun 2025: 15 CVEs · 1 critical · 0 now in CISA KEV · rank #58 · mostly Deno, Deno_node, Deno_runtimeJul 2025: 36 CVEs · 0 critical · 0 now in CISA KEV · rank #30 · mostly Sequoia-openpgp, Cosmwasm-std, Curve25519-dalekAug 2025: 11 CVEs · 0 critical · 0 now in CISA KEV · rank #71 · mostly Id-map, Ntpd-rs, QuicheSep 2025: 16 CVEs · 0 critical · 0 now in CISA KEV · rank #52 · mostly Surrealdb, Fast-able, Frost-coreOct 2025: 17 CVEs · 0 critical · 0 now in CISA KEV · rank #62 · mostly Deno, Tracexec, WasmtimeNov 2025: 12 CVEs · 2 critical · 0 now in CISA KEV · rank #68 · mostly Youki, Apollo-router, Cggmp21Dec 2025: 12 CVEs · 1 critical · 0 now in CISA KEV · rank #72 · mostly Nitro-tpm-pcr-compute, Rtvm-interpreter, RuintJan 2026: 32 CVEs · 4 critical · 0 now in CISA KEV · rank #23 · mostly Rustfs, SM2, Gix-dateFeb 2026: 40 CVEs · 1 critical · 0 now in CISA KEV · rank #21 · mostly Rustfs, Wasmtime, PgpMar 2026: 50 CVEs · 1 critical · 0 now in CISA KEV · rank #23 · mostly Zeptoclaw, Aws-lc-sys, VaultwardenApr 2026: 18 CVEs · 0 critical · 0 now in CISA KEV · rank #52 · mostly Rustls-webpki, Zebrad, Lemmy_api_commonMay 2026: 44 CVEs · 0 critical · 0 now in CISA KEV · rank #23 · mostly Gix, Diesel, Lemmy_apiJun 2026: 10 CVEs · 0 critical · 0 now in CISA KEV · rank #128 · mostly Surrealdb, PYO3, SkillctlJul 2026: 41 CVEs · 0 critical · 0 now in CISA KEV · rank #21 · mostly Surrealdb, Zebrad, Hubuum_clientAug 2026: 10 CVEs · 0 critical · 0 now in CISA KEV · rank #154 · mostly Postgres-protocol, Kcl-lib, Vibeio-http

In the lens

The products that kept showing up in Crates-io's monthly top three from Sep 2021 to Aug 2026. Move the lens and the list follows.

  1. Surrealdb478 months
  2. Ckb195 months
  3. Deno186 months
  4. Openssl-src165 months
  5. Wasmtime125 months
  6. Apollo-router94 months
  7. Rustfs92 months
  8. Rusqlite71 month
  9. Tough72 months
  10. Vaultwarden72 months

Year by year

Each year's months on the top 200 list. Pick a year to read it in the lens.

The record

Peak rank
#4 in Dec 2020
Busiest month
Aug 2021, 90 CVEs
Months with a KEV entry
1 of 72 on the list
On the top 200 list
72 of 124 monthly snapshots

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store