Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-114141Hightoml: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()CVE-2026-114143Hightoml: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()CVE-2026-114144Hightoml: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()CVE-2026-114126Highstorybook: Storybook dev server vulnerable to code injection from the local networkCVE-2026-114128Mediumastro: Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingCVE-2026-114127Lowastro: Astro: Arbitrary CSS injection in Astro View TransitionsCVE-2026-114604High@graphql-tools/utils: GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segmentsCVE-2026-75508Highgraphql-core: GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitCVE-2026-75507Highgraphql-core: GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation ruleGHSA-CG2G-XH64-V4Q7Criticaldompurify: DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modesGHSA-MRV2-3PQR-J5JRHighdompurify: DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for…GHSA-C6GR-QVV4-5V3FLowdompurify: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xmlCVE-2026-114140Highnbconvert: nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidocCVE-2026-114603Mediumopentelemetry-api: OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiCVE-2026-111997Mediumip-address: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the…CVE-2026-114134Highblack: Black: GitHub Action installs unvalidated required-version from pyproject.tomlCVE-2026-114137Highdjangorestframework: Django REST framework: TokenProxy.delete() reports success and revokes nothingCVE-2026-114138Highdjangorestframework: Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationCVE-2026-114136Highdjangorestframework: Django REST framework: JSONParser applies an attacker-named codec to the request streamCVE-2026-103004Mediumnext: next.js cache leak across root param values in nested 'use cache' functionsCVE-2026-110871Mediumnodemailer: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingCVE-2026-96778HighPillow: Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferCVE-2026-96644HighPillow: Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)CVE-2026-96643HighPillow: Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timeCVE-2026-96642HighPillow: Pillow: TarIO negative size field causes infinite CPU-spin loop

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo