Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-XMC9-4F2H-JF9CHighn8n: n8n: Edit Image Node Format Injection Allows Arbitrary File WriteGHSA-CJ9H-QX8G-PQ2GHighn8n: n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSONGHSA-6QC9-MQVW-JG7XHighn8n: n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`GHSA-GV7G-JM28-CR3MHighn8n: n8n: Expression sandbox escape via arrow-function bodies enabling command executionGHSA-2X35-3FW4-9JR4Highn8n: n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type ConfusionGHSA-RCV6-PVRJ-4XCGHighn8n: n8n: Authenticated code execution in the n8n Git nodeGHSA-VHF8-CG2H-CG3PMediumn8n: n8n: SSRF Protection Bypass via MCP Client NodeGHSA-GF29-4F56-R2JFHighn8n: n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path RestrictionGHSA-64XH-79J6-R5V8Highn8n: n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM NodesGHSA-8342-988Q-86CRHighn8n: n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed LoginCVE-2026-65016Highn8n: n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance OwnerCVE-2026-65591Highn8n: n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code ExecutionCVE-2026-65593Mediumn8n: n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network AccessCVE-2026-65595Highn8n: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTsCVE-2026-59208Highn8n: n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity ResolutionCVE-2026-59207Highn8n: n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP ConnectorCVE-2026-59206Highn8n: n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project EnumerationCVE-2026-59209Highn8n: n8n: Shared Credential Header Leak via HTTP Request Pagination ExpressionCVE-2026-59921Mediumio.netty:netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderCVE-2026-59920Mediumio.netty:netty-codec-stomp: Netty: STOMP CONNECT Frame Header Injection in NettyCVE-2026-59919Mediumio.netty:netty-codec-haproxy: Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX AddressCVE-2026-59901Highio.netty:netty-codec-compression: Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread HangCVE-2026-59900Mediumio.netty:netty-codec-http2: Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing BypassCVE-2026-59899Mediumio.netty:netty-codec-http: Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of ServiceCVE-2026-59898Mediumio.netty:netty-codec-http: Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo