Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-113717Lowvirtualenv: virtualenv: Pip seeding with download omits wheel digest verificationCVE-2026-113714Lowvirtualenv: virtualenv: Downloaded wheel selection and caching precede verificationCVE-2026-113718Highvirtualenv: virtualenv: Xonsh activation literals depend on the script decoding codecCVE-2026-113720Mediumvirtualenv: virtualenv: Seeded files retain permissions from an older cacheCVE-2026-113723Highvirtualenv: virtualenv: Bash prompt values can change meaning under older compatibility modesCVE-2026-113715Lowvirtualenv: virtualenv: Venv configuration readback can reinterpret path boundariesCVE-2026-113719Mediumvirtualenv: virtualenv: Seed replacement does not contain metadata deletion pathsCVE-2026-109461High@azure/msal-node: MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpointCVE-2026-109869Highundici: undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsCVE-2026-109924Mediumundici: undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109841Mediumundici: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-115897Lowserialize-javascript: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyCVE-2026-113872Highmulter: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownCVE-2026-115886Mediummlflow: MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsCVE-2026-115883Mediumlanggraph-checkpoint-postgres: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesCVE-2026-115895Highhappy-dom: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executionCVE-2026-115892Mediumwasmtime: Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload typeCVE-2026-115889Criticalwasmtime: Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilationCVE-2026-112906Mediumfilelock: filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuseCVE-2026-112914Mediumfilelock: filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the…CVE-2026-112940Highfilelock: filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process…GHSA-H4FR-CMH5-QR62Lowfallow: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootCVE-2026-115569Lowfallow: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootCVE-2026-112398Criticalpillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionGHSA-F2HQ-32VH-53CCHighpostal-mime: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo