Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-118265Mediumgithub.com/labstack/echo/v5: Echo: X-Real-IP extractor trusts the header value instead of the sending peerCVE-2026-118262Highgithub.com/labstack/echo/v4: Echo: WebSocket proxy can retain connections and handlers after client disconnectCVE-2026-118261Highgithub.com/labstack/echo/v4: Echo: Decompress permits unbounded gzip expansion in v4CVE-2026-118264Criticalgithub.com/labstack/echo/v4: Echo: Rejected WebSocket upgrades can bypass Echo route-level access controlsCVE-2026-118263Mediumgithub.com/labstack/echo/v5: Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requestsCVE-2026-118260Highgithub.com/labstack/echo/v4: Echo: BodyDump captures request and response bodies without size limits in v4CVE-2026-115419Highstrands-agents: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerCVE-2026-115586Highvirtualenv: virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it…CVE-2026-115355Highmistune: Mistune: Path Traversal and XSS in Include directiveCVE-2026-115774MediumTwisted: Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCHCVE-2026-115776HighTwisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line BufferCVE-2026-115778HighTwisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation BufferCVE-2026-115775HighTwisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element TreeCVE-2026-115877MediumTwisted: Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header ValueCVE-2026-114050Mediumvllm: vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engineCVE-2026-114061Low@sveltejs/kit: SvelteKit : XSS via untrusted cache-control header in prerendered pageCVE-2026-115478Highobsidian-tc: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesCVE-2026-62204Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing,…CVE-2026-73054Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the…CVE-2026-73630Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth…CVE-2026-73049Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier…GHSA-XP3Q-R38W-VGQMMediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitizedCVE-2026-77363Criticalobsidian-tc: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopbackCVE-2026-77362Mediumobsidian-tc: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fieldsCVE-2026-115477Highobsidian-tc: obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo