Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-115878Highstanza: Stanza: RCE via pickle deserialization in the lemmatizerCVE-2026-44267Critical@enspirit/elo: Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member accessCVE-2026-44266Critical@enspirit/elo: Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsCVE-2026-44265High@enspirit/elo: Elo backends have code injection via unvalidated emission of programmatic AST fieldsGHSA-P3JP-9V83-76W9HighMicrosoft.DotNet.ILCompiler: Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write VulnerabilityCVE-2026-62331Highgithub.com/mtzanidakis/praktor: praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction…CVE-2026-11800Highorg.keycloak:keycloak-services: Keycloak has authentication bypass via jwt algorithm confusionGHSA-9PPR-WFW9-XVR2Mediumgithub.com/tinfoil-factory/netfoil: Netfoil doesn't decrement TTLCVE-2026-62848HighMetalama.Framework: Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code executionGHSA-M3QR-FVP4-78XJLowgithub.com/basekick-labs/arc: Arc has unauthenticated application log disclosure via `/api/v1/logs`GHSA-J656-3HF2-FVJCMedium@bytebase/dbhub: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationCVE-2026-62374High@sd-jwt/decode: SD JWT JS: Tampered disclosures silently dropped instead of rejectedCVE-2026-118761Highgithub.com/kubeflow/pipelines: Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memoryCVE-2026-118759Highgithub.com/kubeflow/pipelines: Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logsCVE-2026-119203Highpypdf: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer searchCVE-2026-119204Highpypdf: pypdf has possible large memory usage when parsing page treeCVE-2026-119205Highpypdf: pypdf has possible infinite loop when cloning dictionariesCVE-2026-118772Highjoi: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceCVE-2026-119202High@hapi/content: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of serviceCVE-2026-118764Mediumminimatch: minimatch has potential denial of service via globparts amplificationCVE-2026-118773Mediumglob: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-116672HighAuthlib: Authlib RFC 7592 examples omit registration-access-token client bindingCVE-2026-119206Highpypdf: pypdf has possible long runtimes when retrieving page labelsCVE-2026-119207Highpypdf: pypdf has possible large memory usage for exceptions in strict modeCVE-2026-119208Highpypdf: pypdf has possible long runtimes/large memory usage for encrypted PDF files

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo