Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-77366Criticalobsidian-tc: obsidian-tc tokens can access arbitrary configured vaultsCVE-2026-77364Mediumobsidian-tc: obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by defaultCVE-2026-77361Mediumobsidian-tc: obsidian-tc : Symlink read-ACL scope bypass via lexical path checksCVE-2026-106765High@rog0x/mcp-docker-tools: @rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList functionCVE-2026-106763High@justice8096/sagemath-mcp-server: @justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functionsCVE-2026-106764High@rog0x/mcp-git-tools: @rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch functionCVE-2026-113721Mediumvirtualenv: virtualenv: Generated files can follow existing destination linksGHSA-78G4-XQWV-Q3G8Highpillow: Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from…CVE-2026-114132Mediumnuxt: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitiveCVE-2026-114133Mediumnuxt: Nuxt server islands render `useHeadSafe` input without sanitisationCVE-2026-114130Lownuxt: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when…CVE-2026-114131Mediumnuxt: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and…CVE-2026-113789Mediumpypdf: pypdf: Possible long runtimes/large memory usage when retrieving form fieldsCVE-2026-113790Mediumpypdf: pypdf: Possible large memory usage when parsing arrays and dictionariesCVE-2026-113791Mediumpypdf: pypdf: Possible large memory usage when parsing content streamsCVE-2026-113796Mediumelectron: Electron: SameSite cookie restrictions are not applied to windows opened from linksCVE-2026-113798Mediumelectron: Electron: Pointer lock permission requests can be attributed to the wrong frameCVE-2026-113797Lowelectron: Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionCVE-2026-114122Lowelectron: Electron: Frame subscription trusts GPU-supplied frame geometryCVE-2026-114124Lowelectron: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometryCVE-2026-114121Mediumelectron: Electron: openExternal permission requests can be attributed to the wrong originGHSA-673Q-MJM6-R5XRCriticalnext: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arraysCVE-2026-114145HighGitpython: GitPython validates a submodule's ".git" path only after cloning into it (RCE)CVE-2026-107832Lowfastify: fastify is vulnerable to header validation bypass via case-sensitive propertyNamesCVE-2026-114142Hightome: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo