Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-MH25-X5HQ-WRQPHighleague/commonmark: league/commonmark: Denial of service via colliding heading slugsGHSA-JFM3-95JQ-Q3RFHighleague/commonmark: league/commonmark: Denial of service via duplicate footnote definitionsGHSA-G2GP-3WWQ-F4PHHighleague/commonmark: league/commonmark: Denial of service via adjacent inline attribute blocksCVE-2026-71488Highleague/commonmark: league/commonmark: Quadratic-time denial of service when parsing crafted MarkdownCVE-2026-71478Mediumleague/commonmark: league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytesGHSA-5P4M-2WFM-XMQJHighjs-yaml: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backportedCVE-2026-54717Mediumsilverstripe/cms: Silverstripe: XSS in breadcrumbs in page list viewCVE-2026-18654Mediumawscli: AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commandsCVE-2026-71476Highnx: Nx: Zip-Slip in the self-hosted remote cacheCVE-2026-71439Mediummermaid: Mermaid radar diagrams are vulnerable to DoSCVE-2026-71438Lowmermaid: Mermaid configuration APIs allow prototype pollutionCVE-2026-50159Mediummermaid: Mermaid allows CSS injection applying to sibling elements of the diagramCVE-2026-71437Mediummermaid: Mermaid Architecture diagrams are vulnerable to prototype pollutionCVE-2026-55825Lowcontao/contao: Contao: Possible path traversal in job download URIsCVE-2026-71436Mediummermaid: Mermaid XY Charts are vulnerable to an infinite loop DoSCVE-2026-55824Lowcontao/contao: Contao crawler leaks auth credentials to external hostsCVE-2026-71435Mediumstatamic/cms: Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email TemplateCVE-2026-71434Mediumstatamic/cms: Statamic: Missing file upload validation on frontend forms allows uploading disallowed file typesCVE-2026-64662Mediumstatamic/cms: Statamic: Missing authorization on navigation endpoint allows disclosure of restricted entriesCVE-2026-64663Mediumstatamic/cms: Statamic: Unsafe method invocation via Antlers template resolution allows data destructionCVE-2026-64665Highstatamic/cms: Statamic: Account takeover via OAuth email matching without email-verification checkCVE-2026-64664Mediumstatamic/cms: Statamic: Missing authorization on Control Panel endpoint allows disclosure of user existenceCVE-2026-71433Mediumlanggraph-checkpoint-postgres: LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite storesCVE-2026-54763Highgithub.com/traefik/traefik/v2: Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth /…CVE-2026-65600Criticalgithub.com/traefik/traefik/v2: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo