Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-114501MediumPillow: Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1GHSA-8C8M-P3M8-CJG8Mediumnodemailer: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientGHSA-M943-M63M-W62WMediumnodemailer: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientGHSA-85X2-Q946-CP5HMediumnodemailer: Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not nameCVE-2026-114509Criticallaravel/framework: Laravel TokenGuard authentication bypass through non-string API credentialsCVE-2026-114508Mediumlaravel/framework: Laravel relationship inclusion can trigger unauthorized data destructionGHSA-XMJ3-9GF7-H52WLowsetuptools: setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation DescriptionCVE-2026-110306Mediumfast-uri: fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110095Lowfast-uri: fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110180Mediumfast-uri: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110725Lowfast-uri: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesGHSA-7XGJ-8392-5Q4RMediumfastmcp: FastMCP: Post-transform component authorization is skipped on direct callsGHSA-VQQP-X5QM-5QP4Mediumfastmcp: FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised…CVE-2026-114055Highvllm: vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)CVE-2026-114060Low@sveltejs/kit: SvelteKit: URL redirection to untrusted site via enhanced form submissionCVE-2026-114437Mediumgithub.com/go-chi/chi/v5: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-ForGHSA-2RQM-H6HV-G79VMediumodf-kit: odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute valuesCVE-2026-115572Highpypdf: pypdf: Possible long runtimes for repeated references to the same missing objectCVE-2026-115585Highpypdf: pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)CVE-2026-115580Highpypdf: pypdf: Possible long runtimes for large xref table header limitsCVE-2026-115567Mediumtokio: Tokio: Race condition in `tokio::time::Interval`CVE-2026-115570Highelectron: Electron: Mitigation for compromised eMudhra intermediate certificatesCVE-2026-111181Highbody-parser: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyGHSA-Q54R-JF2P-RFR2Highgix: gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()GHSA-MHF7-XP6R-6QRCMediumlivewire/livewire: Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo