Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-76218HighGitPython: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks CVE-2026-76219HighGitPython: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite GHSA-55Q2-FJHQ-7XH7Mediumdompurify: DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS CVE-2026-62996Mediumsmarty/smarty: Smarty Security stream restriction bypass through stream: resource CVE-2026-62992Mediumsmarty/smarty: Smarty: Symlink path traversal out of trusted directories GHSA-WG23-69C2-GJC8Criticalcraftcms/cms: Craft CMS: Passkey login accepts replayed WebAuthn assertions CVE-2026-12261Mediumnltk: NLTK downloader allows cross-package resource and model poisoning CVE-2026-72779Mediumcraftcms/cms: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts CVE-2026-71554Mediumh2: h2: Duplicate Host header could facilitate request smuggling CVE-2026-72782Mediumcraftcms/cms: Craft CMS: Authenticated leak of secret environment variables CVE-2026-72785Mediumcraftcms/cms: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element CVE-2026-14794Mediumcraftcms/cms: Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics CVE-2026-72783Lowcraftcms/cms: Craft CMS: Incorrect path validation could potentially lead to path traversal GHSA-2RP4-X2J7-QMCCMediumcraftcms/cms: Craft CMS: Stored XSS in the control panel via unescaped draft name CVE-2026-67434Highsquizlabs/php_codesniffer: PHP_CodeSniffer gitblame report command injection via crafted filename CVE-2026-71498Mediumre2: node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap…CVE-2026-71430Mediumre2: node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result…GHSA-W9HM-4M3M-FXMMHighngx-extended-pdf-viewer: ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 CVE-2026-16633Highpdfjs-dist: PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF CVE-2026-71497Mediumorg.jsoup:jsoup: jsoup: Cleaner may expose markup with custom raw-text elements GHSA-P8X7-9VFW-P7VCHighcraftcms/cms: Craft CMS: Arbitrary user password reset leading to administrator account takeover CVE-2026-72781Highcraftcms/cms: Craft CMS: Authenticated RCE through Twig sandbox escape CVE-2026-14793Mediumcraftcms/cms: Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets CVE-2026-72778Highcraftcms/cms: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass GHSA-MJ63-M3RC-8PPRMediumleague/commonmark: league/commonmark: Denial of service via deeply nested XML output

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo