Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-3X6R-WXXG-53VVMediumgithub.com/rclone/rclone: rclone: Infinite Scale TUS Creation Transport Error Causes a Nil-Response PanicCVE-2026-71310Mediumgithub.com/rclone/rclone: rclone: Unbounded HTTP CONNECT Response Headers Can Exhaust rclone MemoryCVE-2026-54572Highgithub.com/rclone/rclone: rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remoteCVE-2026-71309Highgithub.com/rclone/rclone: rclone: Incomplete path validation allows backend root escape in serve resticGHSA-945V-V9P3-V5XWLowgithub.com/rclone/rclone: rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remoteGHSA-GWFQ-86J8-7QHVLowgithub.com/rclone/rclone: rclone: Verbose Stack Trace Disclosure in RC API Error ResponsesCVE-2026-70612Mediumelectron: Electron: Sandboxed iframes can launch external protocol handlersCVE-2026-70611Mediumelectron: Electron: DevTools embedder handler executes arbitrary files via shell openCVE-2026-70610Mediumelectron: Electron: contextBridge object copy honors prototype settersCVE-2026-70609Mediumelectron: Electron: DevTools JavaScript Injection via Unsanitized Dock State ParameterCVE-2026-70608Highelectron: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation pathCVE-2026-70607Mediumelectron: Electron: window.open features string controls some window options considered privilegedCVE-2026-70606Mediumelectron: Electron: ProtocolResponse.url reuses the default session cache instead of the registering sessionCVE-2026-70605Mediumelectron: Electron: HTTP redirect followed into local file loaderCVE-2026-70604Highelectron: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin readsCVE-2026-70602Mediumelectron: Electron: Extension tab APIs operate across session boundariesCVE-2026-70603Mediumelectron: Electron: shell.openPath path validation bypass via embedded null byteCVE-2026-70601Highelectron: Electron: Context isolation bypass via Function.prototype.bind hijackCVE-2026-70600Lowelectron: Electron: Cross-origin iframe can position native autofill popupCVE-2026-70599Mediumelectron: Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe OriginCVE-2026-71293Mediumstatamic/cms: Statamic CMS exposes two-factor recovery codes through dynamic Antlers renderingCVE-2026-70598Lowelectron: Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory sizeCVE-2026-70597Mediumelectron: Electron: Parent process code-sign check is spoofableCVE-2026-53949Mediumghost: Ghost Content API filter bypass reveals private fieldsCVE-2026-70596Mediumghost: Ghost: Cross-Site Scripting in Feature Image Captions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo