Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59874Hightar: node-tar: Negative tar entry size causes infinite loop in archive replaceCVE-2026-59875Mediumtar: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath recordsCVE-2026-59725Highengine.io: Socket.IO: Engine.IO Polling Transport Connection ExhaustionCVE-2026-13311Highshell-quote: shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)CVE-2026-61836Highdirectus: Directus: Authorization-dependent response served from unsegmented cache keyCVE-2026-61835Highdirectus: Directus: SSRF Protection Bypass via 0.0.0.0 in File ImportCVE-2026-61740Criticallightrag-hku: LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionGHSA-94PJ-82F3-465WMediumguzzlehttp/guzzle: Guzzle: Proxy-Authorization headers can be sent to origin serversCVE-2026-61736Criticallightrag-hku: LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsCVE-2026-59929Mediummistune: Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionCVE-2026-59930Mediummistune: Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with…CVE-2026-59924Mediummistune: Mistune: Arbitrary File Read via Include directive path traversalCVE-2026-59922Highmistune: Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)CVE-2026-59926Mediummistune: Mistune: XSS via unescaped class option in Admonition directiveCVE-2026-59923Mediummistune: Mistune: XSS via percent-encoded javascript URI bypass in safe_url()CVE-2026-59925Highmistune: Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsCVE-2026-59927Mediummistune: Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two…CVE-2026-59928Highmistune: Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsCVE-2026-59868Mediumjs-yaml: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yamlCVE-2026-59869Highjs-yaml: js-yaml: YAML merge-key chains can force quadratic CPU consumptionCVE-2026-59870Mediumjs-yaml: js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMACVE-2026-55668Mediumgithub.com/filebrowser/filebrowser/v2: File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopeCVE-2026-55667Highgithub.com/filebrowser/filebrowser/v2: File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupCVE-2026-54562Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responsesCVE-2026-54560Highgithub.com/cloudreve/Cloudreve/v4: Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo