Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-119206Highpypdf: pypdf has possible long runtimes when retrieving page labelsCVE-2026-119207Highpypdf: pypdf has possible large memory usage for exceptions in strict modeCVE-2026-119208Highpypdf: pypdf has possible long runtimes/large memory usage for encrypted PDF filesCVE-2026-119209Highpypdf: pypdf has possible large memory usage when parsing cross-reference streamsCVE-2026-119196Highpyasn1: pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingCVE-2026-119197Highpyasn1: pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119195Highpyasn1: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119194Highpyasn1: pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-118775Lownode-forge: Forge: ASN.1 OID first arc truncation in asn1.oidToDerCVE-2026-118777Mediumnode-forge: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieCVE-2026-118778Mediumnode-forge: Forge: TLS client crash when the server sends no certificateCVE-2026-118779Highnode-forge: Forge: Regular expression denial of service in PEM decoding (pem.decode)CVE-2026-118781Lownode-forge: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)CVE-2026-118780Lownode-forge: Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeCVE-2026-119186Mediumnode-forge: Forge: AES-GCM authentication bypass via unvalidated tagLength optionCVE-2026-118782Highnode-forge: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countCVE-2026-119188Highnode-forge: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageCVE-2026-119187Highnode-forge: Forge: Denial of service in TLS record processing via call stack exhaustionCVE-2026-119190Highnode-forge: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13CVE-2026-119193Mediumphpunit/phpunit: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handlingCVE-2026-119201Medium@nuxt/vite-builder: Nuxt dev server exposes generated appSecret through Vite file servingCVE-2026-119200Mediumnuxt: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesCVE-2026-119198Medium@nuxt/vite-builder: Nuxt dev server arbitrary file read through client error reportsCVE-2026-119199Medium@nuxt/vite-builder: Nuxt dev server exposes private runtime config through the Nitro dev bundleCVE-2026-118763High@sigstore/oci: @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo