Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49977Mediumtarteaucitronjs: tarteaucitron: data-cookie attribute can be used to delete arbitrary cookiesCVE-2026-49866High@libp2p/gossipsub: libp2p: CPU DoS via oversized IHAVE and IWANT control message arraysCVE-2026-49865Mediumkimai/kimai: Kimai has Server-Side Request Forgery in Invoice PDF Rendering via Markdown Image URLsCVE-2026-5078Mediummorgan: morgan vulnerable to Log Forging via unneutralized control characters in :remote-userCVE-2026-49858Mediumapi-platform/core: API Platform Core vulnerable to cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gateCVE-2026-39243Mediumdecompress: decompress allows arbitrary hardlink creation during archive extractionCVE-2026-49851Highmistune: Mistune: Potential DoS via quadratic-time parsing in parse_link_textCVE-2026-49838Mediumgithub.com/osrg/gobgp/v4: GoBGP confederation validation panics on empty AS_PATH attributeCVE-2026-49837Mediumgithub.com/osrg/gobgp/v4: GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundariesCVE-2026-49836Mediumpsd-tools: psd-tools vulnerable to arbitrary file write via smart-object filenameCVE-2026-49834Mediumgithub.com/sigstore/sigstore-go: sigstore-go has a multi-log threshold bypass via single compromised logCVE-2026-53956Mediumrattler_cache: Rattler vulnerable to package cache path traversal via conda package build stringCVE-2026-55252Mediumgithub.com/openrundev/openrun: OpenRun: Redirect URL validation bypass using  //host  paths leads to Open RedirectCVE-2026-54651Mediumpypdf: pypdf: Possible infinite loop when processing threads/articles in writerCVE-2026-53639Mediumsylius/sylius: Sylius: IDOR on Shop Payment Request API endpointsCVE-2026-53638Mediumsylius/sylius: Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo