Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-116588Highddtrace: Datadog dd-trace-py: ReDoS in URL query string obfuscationCVE-2026-116589Highddtrace: Datadog dd-trace-py: IAST instrumentation can lead to application DOSCVE-2026-106435Highpymongo: MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex elementCVE-2026-114053Highvllm: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code executionGHSA-3W55-933P-8PV5Highstrands-agents: Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File StorageGHSA-763V-5PJM-FX36Mediumstrands-agents: Strands Agents: Default FileSessionManager storage is world-readable on shared systemsCVE-2026-93451Highorg.xerial.snappy:snappy-java: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methodsCVE-2026-116590Mediumorg.xerial.snappy:snappy-java: snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWriteCVE-2026-108106Highorg.xerial.snappy:snappy-java: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengthaCVE-2026-114510Highflexible-graphrag: Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from…GHSA-G5FF-637F-6Q2MHighlitellm: LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`GHSA-44JH-23M7-HPCFLow@better-auth/drizzle-adapter: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQLGHSA-R4XP-PRCW-77QFHighbetter-auth: better-auth: OAuth Proxy lets an attacker sign in as another userCVE-2026-114607Criticalbetter-auth: better-auth: OAuth state can be used as a Magic Link to sign in as another userGHSA-HHWW-MRG2-969HMediumlitellm: LiteLLM vulnerable to reflected XSS in /sso/debug/callbackGHSA-23MF-XHV8-69C2HighGitPython: GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)GHSA-GQ48-PQFC-9P58MediumGitPython: GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktreeGHSA-F9J4-QGGQ-H239HighGitPython: GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command executionGHSA-W8JC-G24H-CRHWHighGitPython: GitPython command wrappers omit unsafe protocol and option checksGHSA-FX3J-RWGX-FR94MediumGitPython: GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule nameGHSA-M64X-33Q8-M5H7HighGitPython: GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity linesGHSA-4FFR-JQ9G-5FFXMediumnodemailer: Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of serviceGHSA-G73G-HQQH-JR95Mediumnodemailer: Nodemailer: RFC 5322 comment inside an angle-bracket address is never strippedGHSA-4G23-2XM8-66GCMediumnodemailer: Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of serviceCVE-2026-114612Highlitellm: LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo