Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-57108HighMicrosoft.NetCore.App.Runtime.linux-arm: Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service VulnerabilityCVE-2026-67320Highaxios: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningCVE-2026-67321Mediumaxios: Axios form serializer maxDepth bypass via {} metatokenCVE-2026-67319Mediumaxios: Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67318Mediumaxios: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`CVE-2026-67317Mediumaxios: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`CVE-2026-67316Mediumaxios: Axios: Prototype pollution gadgets can alter axios request constructionCVE-2026-67315Mediumaxios: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosCVE-2026-62685Highgithub.com/filebrowser/filebrowser/v2: File Browser: Colliding username normalization gives two users the same home directoryCVE-2026-62684Lowgithub.com/filebrowser/filebrowser/v2: File Browser: Share API exposes the password hash and bypass tokenCVE-2026-62843Mediumgithub.com/filebrowser/filebrowser/v2: File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)CVE-2026-59876Mediumprotobufjs: protobufjs: Text Format string map parsing can mutate returned map object prototypeCVE-2026-59877Mediumprotobufjs: protobufjs: Denial of Service via infinite loop in .proto option parsingCVE-2026-14631Mediumwebpack-dev-server: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin headerCVE-2026-14620Mediumwebpack-dev-server: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpointsCVE-2026-59883Mediumguzzlehttp/guzzle: Guzzle: Cookie Disclosure and Injection via IP-Address DomainsCVE-2026-59731Highastro: Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization MismatchCVE-2026-59946Mediumcomposer/composer: Composer: Path traversal in package bin field lets dependencies chmod arbitrary host filesCVE-2026-59947Mediumcomposer/composer: Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)CVE-2026-59871Mediumtar: node-tar: Process crash via PAX numeric path type confusionCVE-2026-59873Criticaltar: node-tar: Decompression/parse DoS via unlimited inputCVE-2026-59874Hightar: node-tar: Negative tar entry size causes infinite loop in archive replaceCVE-2026-59875Mediumtar: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsCVE-2026-59725Highengine.io: Socket.IO: Engine.IO Polling Transport Connection ExhaustionCVE-2026-13311Highshell-quote: shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo