Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-114613Highmsgpack: MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failureGHSA-J456-XH4H-CPF2Highnltk: NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containmentCVE-2026-96760Criticalauthlib: Authlib: empty signatures validation in JWS JSON deserializationGHSA-Q84F-53JG-9PPMHighbetter-auth: better-auth: Device login approval does not show the requesting client or permissionsCVE-2026-114608Mediumpylint: Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOMECVE-2026-94545Mediumsatori: Satori-generated SVG has improper escapingCVE-2026-94624Mediumvllm: vllm p2p never connected zmq_exhaustionCVE-2026-115924Highrembg: Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphsCVE-2026-83813LowTwisted: Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address ValidationCVE-2026-103288Mediumghost: Ghost: Authorization Bypass in Comment Like FeatureCVE-2026-60083Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and…CVE-2026-114610Mediumfpdf2: fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'CVE-2026-114609Mediumfpdf2: fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled contentCVE-2026-102554Highcom.google.guava:guava: Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-35002Criticalagno: Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`CVE-2026-49272Highoauthlib: OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflowCVE-2026-48705Criticalmonai: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)CVE-2026-46350Lowdcmjs: dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASSCVE-2026-34157Highgithub.com/wailsapp/wails/v2: Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOriginsCVE-2026-33944Highdolibarr/dolibarr: Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameterCVE-2026-27975Highaj: Ajenti has potential Remote Code ExecutionCVE-2026-112937Mediumfilelock: filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory nameCVE-2026-112913Lowfilelock: filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its databaseCVE-2026-112907Lowfilelock: filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale breakCVE-2026-113713Mediumvirtualenv: virtualenv: Temporary app-data can leave dangling seed package links

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo