Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-69192Highip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypassCVE-2026-69198Mediumip-address: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksCVE-2026-54272Mediumip-address: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checksCVE-2026-15157Mediumundici: undici vulnerable to CRLF Injection via blob-like body 'type' propertyCVE-2026-14643Mediumundici: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesCVE-2026-16729Mediumundici: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fieldsCVE-2026-16728Mediumundici: undici vulnerable to downstream response desynchronization via retry interceptorCVE-2026-13697Highundici: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesCVE-2026-18446Highfast-uri: fast-uri vulnerable to host confusion via backslash authority introducerCVE-2026-69185Highsocket.io-parser: Socket.IO: Zero-attachment Memory ExhaustionCVE-2026-69153Mediumpostcss: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetCVE-2026-69152Highbrace-expansion: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69151High@angular/compiler: Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesCVE-2026-69149High@angular/platform-server: Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)CVE-2026-68945High@angular/common: Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State PoisoningCVE-2026-68930Mediumrussh: Russh: Channel-scoped server callbacks can be reached without an open channelCVE-2026-13506Highorg.bouncycastle:bcprov-jdk18on: Bouncy Castle: Lazy ASN.1 sequence forcing resets nesting-depth guardCVE-2026-8763Criticalorg.bouncycastle:bc-fips: Bouncy Castle: Name Constraints bypass via trailing dot in rfc822Name and URICVE-2026-9856Hightransformers: Transformers save_pretrained path traversal allows arbitrary file writes through chat template namesCVE-2026-9335Mediumkeras: Keras: HDF5 links can disclose local file contentsCVE-2026-54910Highgithub.com/gtsteffaniak/filebrowser/backend: FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary filesCVE-2016-1000305Mediumguard-livereload: guard-livereload has a directory traversal vulnerabilityCVE-2026-54785Mediumgemini-bridge: gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline modeCVE-2026-54768Mediumwp-graphql/wp-graphql: WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit…CVE-2026-53573Mediumorg.geonetwork-opensource:geonetwork: core-geonetwork has an Open Redirect Bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo