Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-F897-62HF-6GXQHigh@modelcontextprotocol/sdk: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch lengthCVE-2026-109413Highsymfony/symfony: Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the ProcessCVE-2026-108082Highsymfony/http-foundation: Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request HeaderCVE-2026-116587Highgithub.com/go-jose/go-jose/v4: Go JOSE: DoS when parsing JWKs that contain RSA keysCVE-2026-116683Highgithub.com/ctfer-io/terraform-provider-ctfd: CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive valuesGHSA-WF6J-7HVR-GR93Highhydra-core: Hydra legacy target blacklist permits unsafe PyYAML loadingCVE-2026-110816Mediumqs: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)CVE-2026-109855Highundici: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshakeCVE-2026-114616HighAuthlib: Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)GHSA-VP88-798V-H67FLowrustls: rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alertGHSA-W44R-93J7-QV28Lowrustls: rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 shareGHSA-C8M5-C952-6CM4Mediumrustls: Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKsGHSA-H2V8-394M-P7VVLowrustls: Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.CVE-2026-114620Mediumauthlib: Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFCVE-2026-114617Mediumauthlib: Authlib: ID token can disable its own nonce validation via the nonce_supported claimCVE-2026-114618Mediumauthlib: Authlib: Default JWT bearer grant accepts assertions for the wrong audienceCVE-2026-114619Mediumauthlib: Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensCVE-2026-114615Highauthlib: Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysCVE-2026-108360Mediumphpoffice/phpspreadsheet: PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loadingCVE-2026-108359Highphpoffice/phpspreadsheet: PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)CVE-2026-108358Highphpoffice/phpspreadsheet: PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServiceCVE-2026-108357Highphpoffice/phpspreadsheet: PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServiceCVE-2026-116591Highgithub.com/klauspost/compress/zstd: compress zstd: Panic on two-block framesCVE-2026-114614Lowauthlib: Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…CVE-2026-114605Highdnspython: dnspython dns.name.from_wire_parser() excessive CPU use

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo