Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-8798Highorg.bouncycastle:bc-fips: Bouncy Castle: the native entropy source used on Intel platforms retried the CPU entropy instructions without any boundCVE-2026-13505Highorg.bouncycastle:bc-fips: Bouncy Castle: Zeroisation of sensitive key material on garbage collection relies on finalization.CVE-2026-71870Mediumpypdf: pypdf: Possible large memory usage for large /ToUnicode streamsCVE-2026-71852Mediumpypdf: pypdf: Possible long runtimes/large memory usage for large CID font width rangesCVE-2026-71851Criticalcrypto-js: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency ChainCVE-2026-71850Mediumhono: Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosureCVE-2026-71849Lowhono: Hono: Proxy Helper does not remove response headers listed in the `Connection` headerCVE-2026-71848Mediumhono: Hono: Algorithmic Complexity DoS in Language MiddlewareCVE-2026-71847Lowjson: Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streamsCVE-2026-67422Highpymdown-extensions: pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processorsCVE-2026-63223Criticalcodeigniter4/framework: CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rulesCVE-2026-63222Highcodeigniter4/framework: CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenamesCVE-2026-63221Criticalcodeigniter4/framework: CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditionsCVE-2026-63220Mediumcodeigniter4/framework: CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()CVE-2026-15895Highjsii-diff: jsii-diff: Command Injection via npm: package argumentCVE-2026-56818Mediumio.netty:netty-codec-redis: Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate stateCVE-2026-54164Mediumapi-platform/core: API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)CVE-2026-66062Medium@sveltejs/kit: SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headerCVE-2026-72744Mediumnuxt: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpointCVE-2026-71557Mediumgithub.com/go-git/go-git/v5: go-git: Malicious reference names may modify files outside the reference storageCVE-2026-71556Highgithub.com/go-git/go-git/v5: go-git: Worktree operations may follow symlinksCVE-2026-76220HighGitPython: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command executionGHSA-JM78-9FVV-MHGRHighGitPython: GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)CVE-2026-76222HighGitPython: GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPythonCVE-2026-76217MediumGitPython: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo