Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-56822Highio.netty:netty-handler-ssl-ocsp: Netty: TOCTOU in OcspServerCertificateValidatorCVE-2026-56821Highio.netty:netty-handler-ssl-ocsp: Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidatorCVE-2026-56820Highio.netty:netty-handler-ssl-ocsp: Netty: Missing CertificateID Validation in OCSP Response Allows Replay AttacksCVE-2026-56817Highio.netty:netty-codec-xml: Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handlingCVE-2026-56816Highio.netty:netty-codec-http3: Netty: Memory Exhaustion via HTTP/3 Reserved Frame TypesCVE-2026-56746Mediumio.netty:netty-codec-http: Netty: Security Control Bypass via CORS Short-Circuit FailureCVE-2026-56745Highio.netty:netty-codec-http: Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory ExhaustionCVE-2026-56722Mediumdompdf/dompdf: Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URICVE-2026-55851Highio.netty:netty-codec-haproxy: Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory ExhaustionCVE-2026-55833Highio.netty:netty-codec-http: Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationCVE-2026-55831Highio.netty:netty-codec-http: Netty SPDY SETTINGS frame count materializes unbounded settings mapCVE-2026-55555Lowdompdf/dompdf: Dompdf: File existence oracle via font-face stylesheet declarationCVE-2026-55554Lowdompdf/dompdf: Dompdf: Chroot Validation BypassCVE-2026-65599Mediumn8n: n8n: Google Service Account Private Key Exposed in JWT HeaderCVE-2026-65592Highn8n: n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`CVE-2026-65597Highn8n: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML PreviewCVE-2026-65598Highn8n: n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code ExecutionCVE-2026-65015Highn8n: n8n: AI Agents Project Viewer Privilege Escalation via run_node_toolCVE-2026-45820Mediumfflate: fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archivesCVE-2026-16221Highfast-uri: fast-uri vulnerable to host confusion via literal backslash authority delimiterGHSA-F88M-G3JW-G9CJHighsharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591CVE-2026-73569Highfast-xml-parser: fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limitsCVE-2026-67322HighGitPython: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URLCVE-2026-73648Mediumrails-html-sanitizer: Rails HTML Sanitizers: Possible XSS vulnerability with certain configurationsCVE-2026-73565Medium@hono/node-server: Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo