kuva
A scientific plotting library in Rust
View on Github
Activity
- Latest release
- 2w ago
- Total releases
- 14
- Cadence
- ~7 days
- Last 12 months
- 14
Reach
- Downloads
- 31.6k
- Stars
- 884
Details
- License
- MIT
- First release
- Feb 28, 2026
| Version | Released | |
|---|---|---|
0.6.0
minor
|
0.6.0
minor
Dependencies (26)
+ 18 more
Changelog
Compare changes
|
|
0.3.1
patch
|
0.3.1
patch
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
0.4.1
patch
|
0.4.1
patch
Dependencies (19)
+ 11 more
Changelog
Compare changes
|
|
0.5.0
minor
|
0.5.0
minor
Dependencies (22)
+ 14 more
Changelog
Compare changes
|
|
0.4.0
unknown
1 CVE
RUSTSEC-2026-0345
GHSA-3c48-9r95-hqhr
Aug 07, 2026
Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences Affected versions of 1. SVG attribute injection / stored XSS (CWE-79). When SVG interactivity
was enabled via 2. Unvalidated CSS and style attribute values (CWE-74). 3. Terminal escape sequence injection (CWE-150). The fix routes every data-derived string through format-appropriate
escaping. A single Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for users still on 0.1.5 through 0.3.0. No versions were yanked. Users who cannot upgrade should sanitize labels before passing them to
Note that Fixed in
0.3.1
0.4.1
References
Updated Oct 13, 2026 · Source: OSV.dev |
0.4.0
unknown
Dependencies (19)
+ 11 more
Changelog
Compare changes
|
|
0.3.0
unknown
1 CVE
RUSTSEC-2026-0345
GHSA-3c48-9r95-hqhr
Aug 07, 2026
Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences Affected versions of 1. SVG attribute injection / stored XSS (CWE-79). When SVG interactivity
was enabled via 2. Unvalidated CSS and style attribute values (CWE-74). 3. Terminal escape sequence injection (CWE-150). The fix routes every data-derived string through format-appropriate
escaping. A single Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for users still on 0.1.5 through 0.3.0. No versions were yanked. Users who cannot upgrade should sanitize labels before passing them to
Note that Fixed in
0.3.1
0.4.1
References
Updated Oct 13, 2026 · Source: OSV.dev |
0.3.0
unknown
Dependencies (18)
+ 10 more
Changelog
Compare changes
|
|
0.2.0
unknown
1 CVE
RUSTSEC-2026-0345
GHSA-3c48-9r95-hqhr
Aug 07, 2026
Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences Affected versions of 1. SVG attribute injection / stored XSS (CWE-79). When SVG interactivity
was enabled via 2. Unvalidated CSS and style attribute values (CWE-74). 3. Terminal escape sequence injection (CWE-150). The fix routes every data-derived string through format-appropriate
escaping. A single Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for users still on 0.1.5 through 0.3.0. No versions were yanked. Users who cannot upgrade should sanitize labels before passing them to
Note that Fixed in
0.3.1
0.4.1
References
Updated Oct 13, 2026 · Source: OSV.dev | ||
0.1.6
unknown
1 CVE
RUSTSEC-2026-0345
GHSA-3c48-9r95-hqhr
Aug 07, 2026
Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences Affected versions of 1. SVG attribute injection / stored XSS (CWE-79). When SVG interactivity
was enabled via 2. Unvalidated CSS and style attribute values (CWE-74). 3. Terminal escape sequence injection (CWE-150). The fix routes every data-derived string through format-appropriate
escaping. A single Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for users still on 0.1.5 through 0.3.0. No versions were yanked. Users who cannot upgrade should sanitize labels before passing them to
Note that Fixed in
0.3.1
0.4.1
References
Updated Oct 13, 2026 · Source: OSV.dev | ||
0.1.5
unknown
1 CVE
RUSTSEC-2026-0345
GHSA-3c48-9r95-hqhr
Aug 07, 2026
Untrusted labels can inject SVG attributes, CSS values, and terminal escape sequences Affected versions of 1. SVG attribute injection / stored XSS (CWE-79). When SVG interactivity
was enabled via 2. Unvalidated CSS and style attribute values (CWE-74). 3. Terminal escape sequence injection (CWE-150). The fix routes every data-derived string through format-appropriate
escaping. A single Patched in 0.5.0, with backports to 0.4.1 for the 0.4.x line and 0.3.1 for users still on 0.1.5 through 0.3.0. No versions were yanked. Users who cannot upgrade should sanitize labels before passing them to
Note that Fixed in
0.3.1
0.4.1
References
Updated Oct 13, 2026 · Source: OSV.dev | ||
0.1.4
unknown
| ||
0.1.3
unknown
| ||
0.1.2
unknown
| ||
0.1.1
unknown
| ||
0.1.0
unknown
|