Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-113648Low@apostrophecms/import-export: ApostropheCMS: Missing Authentication in `cleanExport` RouteCVE-2026-112954Mediumapostrophe: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APICVE-2026-112951Mediumapostrophe: ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixCVE-2026-113650Mediumsanitize-html: ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not…CVE-2026-113649Medium@apostrophecms/import-export: ApostropheCMS: Import API bypasses publication roles for protected contentCVE-2026-112956Medium@apostrophecms/import-export: ApostropheCMS: Archive duplicate continuation lets contributors overwrite published contentCVE-2026-112955Medium@apostrophecms/import-export: ApostropheCMS: Import archives can exhaust server storage and deny serviceCVE-2026-113792Mediumpypdf: pypdf: Possible infinite loop in PdfWriter.find_outline_itemCVE-2026-113793Mediumpypdf: pypdf: Possible infinite loop when removing tree itemsCVE-2026-113794Mediumpypdf: pypdf: Possible infinite loop when hitting EOF in standard xref tableCVE-2026-113725Highvirtualenv: virtualenv bash activate runs commands from an environment name with a backslash before $CVE-2026-113795Mediumpypdf: pypdf: Possible large memory usage for streams with multiple filtersCVE-2026-112945Lowvite: Vite: Cross origin script execution through Vite custom middlewareCVE-2026-112946Mediumvite: Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineCVE-2026-112947Mediumvite: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-113726Highvirtualenv: virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTCVE-2026-113732Highvirtualenv: virtualenv activate.fish runs commands from a path or prompt with a backslash before a quoteCVE-2026-113776Highvirtualenv: virtualenv activation scripts run code from a path that contains a placeholder nameCVE-2026-113799Mediumslack-morphism: Slack Morphism verifier errors disclose valid HMACs in the logsCVE-2026-113730Mediumognl:ognl: OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxiesCVE-2026-113727Highgithub.com/openchoreo/openchoreo: OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runsCVE-2026-113729Highgithub.com/moov-io/signedxml: Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalizationCVE-2026-114386Mediumpydantic-ai-harness: Pydantic AI Harness tool-call limit bypass in nested CodeMode callsCVE-2026-113711Highapostrophe: ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportCVE-2026-113712Mediumcachethq/cachet: Cachet has Stored XSS in Incident Component

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo