Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59932Highphpoffice/phpspreadsheet: PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustionCVE-2026-59931Highphpoffice/phpspreadsheet: PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelistCVE-2026-73421Criticalnext-auth: Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)CVE-2026-73418High@auth/core: Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headersCVE-2026-73420Critical@auth/core: Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassCVE-2026-73419Medium@auth/core: Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created themCVE-2026-16723Criticalcom.alibaba:fastjson: fastjson has a remote code execution (RCE) vulnerabilityCVE-2026-16629Mediumdanger: danger allows local OS command injection through crafted file pathsGHSA-652Q-GVQ3-74QVMediumn8n: n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression InterpolationGHSA-JQWR-VX3P-R266Mediumn8n: n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL InstancesGHSA-9CMH-XCQM-5HQRMediumn8n: n8n: Cross-Tenant Module-Cache Poisoning in the JS Task RunnerCVE-2026-73417Highjupyterlab: JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)CVE-2026-73415Highjupyterlab: JupyterLab: Image viewer allows XSS when opening malicious image in new browser tabCVE-2026-73416Mediumjupyterlab: JupyterLab: PyPI extension blocklist package-name canonicalization bypassGHSA-H5V5-8746-G7MMMediumjupyterlab: JupyterLab PluginManager lock-rule enforcement bypassGHSA-WHVH-WF3X-G77JLowjupyterlab: JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)CVE-2026-64649Highnext: Next.js: Server-Side Request Forgery in Server Actions on custom serversCVE-2026-64648Mediumnext: Next.js: Cache confusion of response bodies for requests with bodiesCVE-2026-64647Mediumnext: Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequencesCVE-2026-64646Mediumnext: Next.js: Unbounded Server Action payload in Edge runtimeCVE-2026-64645Highnext: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnameCVE-2026-64644Mediumnext: Next.js: Denial of Service in the Image Optimization API using SVGsCVE-2026-64643Mediumnext: Next.js: Unauthenticated disclosure of internal Server Function endpointsCVE-2026-64642Highnext: Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localeCVE-2026-64641Highnext: Next.js: Denial of Service in App Router using Server Actions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo