Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-96641Mediumpillow: Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromiseCVE-2026-96640HighPillow: Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionCVE-2026-96639CriticalPillow: Pillow multi-frame loaders can reuse stale native image storage after mode transitionsCVE-2026-96638Mediumpillow: Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modeCVE-2026-96637Highpillow: Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSCVE-2026-96636MediumPillow: Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)CVE-2026-114139Critical@sentry/nextjs: Sentry-Javascript: Middleware Bypass when using Tunnel routeGHSA-2464-FHR4-W9XWCriticalnext: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are usedCVE-2026-96889Highlibrsvg: Librsvg: Use-after-free when XML includes have duplicated entitiesCVE-2026-94482Highnext: Next.js: Denial of Service in App Router using Server ActionsCVE-2026-114129Mediumstream-json: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of serviceGHSA-PXH4-856F-4H89Highpyjwt: PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgeryCVE-2026-114135Highjupyter-server: Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorizationCVE-2026-111497Criticalbrotli: Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli packageCVE-2026-63430Mediumammonia: ammonia: mXSS via MathML `annotation-xml` encoding stripCVE-2026-115324Criticalmem0ai: mem0ai Databricks vector store vulnerable to SQL injectionCVE-2026-113716Mediumvirtualenv: virtualenv: Builtin creation follows linked environment directoriesCVE-2026-113724Mediumvirtualenv: virtualenv: Deletion recovery can change a symlink target's modeCVE-2026-113722Highvirtualenv: virtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxCVE-2026-112902HighPillow: Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tagsCVE-2026-112393CriticalPillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOCVE-2026-112396Mediumpillow: Pillow: Heap use-after-free when encoding TIFF to an in-memory bufferCVE-2026-112406HighPillow: Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycleCVE-2026-112399HighPillow: Pillow: APNG background disposal allocates full canvas before decompression bomb checkCVE-2026-112892Highpillow: Pillow: MSP RLE decoder expands a tiny file into unbounded memory

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo