Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59902Highio.netty:netty-transport-sctp: Netty: Memory Exhaustion in SctpMessageCompletionHandlerGHSA-FHGH-WQ4Q-R37XHighgitlab.com/uniget-org/cli: uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is setCVE-2026-59893Highsqlparse: sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)CVE-2026-54284Highsqlparse: sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerCVE-2026-55090Highep_etherpad-lite: Etherpad has stored XSS in HTML export via unescaped attribute-pool valuesGHSA-92HR-GMR6-H8CPMediumep_etherpad-lite: Etherpad addressed weak token RNG, login timing, plugin path handling, API request handlingCVE-2026-55062Mediumgitlab.com/uniget-org/cli: uniget CLI has Path Traversal in Hook Files - Directory Escape VulnerabilityCVE-2026-55061Mediumgitlab.com/uniget-org/cli: uniget CLI has an EDITOR Command InjectionGHSA-V836-6XW4-9CX3Highvm2: vm2 has Memory Exhaustion DoS via bufferAllocLimit BypassGHSA-M5W8-4GQ2-6F8XCriticalvm2: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of…CVE-2026-47698Criticalvm2: vm2: Sandbox Breakout Using Dangerous Host Proto MutatorsCVE-2026-47686Criticalvm2: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCECVE-2026-47683Highvm2: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLikeCVE-2026-71491Highsqlparse: sqlparse: Quadratic O(n²) DoS in group_commentsCVE-2026-68520Mediumglances: Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/configCVE-2026-68519Highglances: Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)CVE-2026-62982Highglances: Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command…CVE-2026-59894Mediumsqlparse: sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-68517Mediumglances: Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing…CVE-2026-45099Mediumgithub.com/gruntwork-io/terragrunt: Terragrunt: Arbitrary File Deletion via Malicious Module ManifestCVE-2026-68518Highglances: Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstructionCVE-2026-64865Mediumgithub.com/QuantumNous/new-api: New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypassCVE-2026-71479Criticalgithub.com/QuantumNous/new-api: New API: Integer overflow in quota billing yields negative charges (self-crediting)CVE-2026-64866Mediumgithub.com/QuantumNous/new-api: New API: Admin can reset passkeys for same-level or higher-privileged usersCVE-2026-64868Highgithub.com/QuantumNous/new-api: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo