Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59885Highpyasn1: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceCVE-2026-59884Highpyasn1: pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsCVE-2026-59890Mediumsetuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+CVE-2026-59892High@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed headerCVE-2026-59887Highlinkify-it: linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker textCVE-2026-13760Highaws-cdk-lib: aws-cdk-lib: OS Command Injection in NodejsFunction Docker BundlingCVE-2026-13676Highfast-uri: fast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-59880Highimmutable: Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/SetCVE-2026-59879Highimmutable: Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59882Mediumguzzlehttp/psr7: guzzlehttp/psr7: Host Confusion via Weak URI Host ValidationCVE-2026-61666Highwebsocket-driver: websocket-driver-ruby: Denial of service via malformed Host headerCVE-2026-59896Mediumhono: hono/jsx does not isolate context per request, leading to cross-request data disclosureCVE-2026-59895Mediumhono: Hono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityCVE-2026-64825Criticalhomeassistant: Home Assistant Core vulnerable to Path Traversal via backup upload during onboardingCVE-2026-59897Mediumhono: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationGHSA-FRVP-7C67-39W9Medium@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)CVE-2026-54291Highorg.postgresql:postgresql: PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithmsCVE-2026-56170HighMicrosoft.AspNetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2026-56170 – .NET Denial of Service VulnerabilityCVE-2026-50526HighMicrosoft.NET.Build.Containers: Microsoft Security Advisory CVE-2026-50526 – .NET Tampering VulnerabilityCVE-2026-47300HighMicrosoft.AspNetCore.Authentication.Negotiate: Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege VulnerabilityCVE-2026-47303HighMicrosoft.AspNetCore.Authentication.Negotiate: Microsoft Security Advisory CVE-2026-47303 – .NET Elevation of Privilege VulnerabilityCVE-2026-50527HighSystem.Security.Cryptography.Xml: Microsoft Security Advisory CVE-2026-50527 – .NET Denial of Service VulnerabilityCVE-2026-50650HighMicrosoft.WindowsDesktop.App.Runtime.win-x64: Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege VulnerabilityCVE-2026-73491Lowloofah: Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesCVE-2026-67354Mediumguzzlehttp/guzzle: Guzzle: URI fragments disclosed in redirect Referer headers

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo