Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59220Mediumopen-webui: Open WebUI: ReDoS in skill-mention regexes causes whole-instance DoS on default configCVE-2026-59226Lowopen-webui: Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocationCVE-2026-59218Mediumopen-webui: Open WebUI: Account enumeration via observable login timing discrepancyCVE-2026-59214Highopen-webui: Open WebUI: Stored web worker XSS via PyodideCVE-2026-55607High@anthropic-ai/claude-code: Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionCVE-2026-73507Highio.netty:netty-codec-xml: Netty: Denial of Service in XmlFrameDecoder via CPU ExhaustionCVE-2026-73508Mediumio.netty:netty-codec-dns: Netty: Memory Leak in DNS Record Decoder via Malformed Domain NamesGHSA-R277-6W6Q-XMQWCriticalgithub.com/getkin/kin-openapi: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc DefaultGHSA-GCJH-H69Q-9W9GMediumgithub.com/google/cel-go: cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTagCVE-2026-73643Highjs-yaml: js-yaml: Exponential parsing time in flow collections leads to denial of serviceCVE-2026-73429Mediumrussh: Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)CVE-2026-73489Mediumrussh: Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode recordsCVE-2026-73430Mediumrussh: Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)GHSA-QWWW-VCR4-C8H2Highreact-router: React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 ResponseGHSA-464C-974J-9XM6Lowaws-cdk-lib: AWS CDK CodeBuild S3 Log Encryption Boolean InversionCVE-2026-7120Medium@fastify/static: @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL PathsCVE-2026-15074High@fastify/static: @fastify/static vulnerable to route guard bypass via path traversalGHSA-R9MR-M37C-5FR3HighGitPython: GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command executionGHSA-6P8H-3WGX-97GFHighGitPython: GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooksGHSA-FJR4-X663-MWXCHighGitPython: GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)CVE-2026-73566Hightar: node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selectionCVE-2026-73646Highpostcss: PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File DisclosureGHSA-W28W-GP39-M4P6Critical@prompty/core: Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks RendererCVE-2026-73562Mediummongoose: Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)CVE-2026-69097Highgitpython: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo