Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-112894HighPillow: Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)CVE-2026-112391MediumPillow: Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()CVE-2026-112901MediumPillow: Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutesCVE-2026-112898MediumPillow: Pillow: Image.quantize() with empty palette leaks uninitialized stack memoryCVE-2026-112401MediumPillow: Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()CVE-2026-112390HighPillow: Pillow: Infinite loop in MIC n_frames when the embedded TIFFCVE-2026-112891Mediumpillow: Pillow: Quadratic GIF comment copying during saveCVE-2026-112392HighPillow: Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagesCVE-2026-112405Highpillow: Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0CVE-2026-112893Highpillow: Pillow: Invalid free in FreeType glyph rendering when a stroker is activeCVE-2026-112402HighPillow: Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformCVE-2026-112394MediumPillow: Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizeCVE-2026-112900CriticalPillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCECVE-2026-113786Lowpypdf: pypdf: Unvalidated JPEG image data loadingCVE-2026-112948Medium@vitest/ui: Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileCVE-2026-112949Medium@vitest/mocker: Vitest: Code injection via unauthenticated manual mock registrationCVE-2026-112950Medium@vitest/mocker: Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixCVE-2026-112953Medium@apostrophecms/import-export: ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesCVE-2026-62197Mediumopenclaw: OpenClaw: Browser CDP discovery could accept blocked WebSocket URLsCVE-2026-114125Criticalstorybook: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitesCVE-2026-113800Mediumelectron: Electron: HID and USB permission checks can be attributed to the wrong originCVE-2026-113731Lowdjust: djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP toolCVE-2026-112952Mediumapostrophe: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userCVE-2026-112957Mediumapostrophe: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to…CVE-2026-112958Mediumapostrophe: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo