Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-111762Mediumorg.a2aproject.sdk:a2a-java-sdk-transport-rest: A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failureCVE-2026-111765Highorg.a2aproject.sdk:a2a-java-sdk-http-client-android: A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixCVE-2026-111761Mediumorg.a2aproject.sdk:a2a-java-sdk-server-common: A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification deliveryCVE-2026-111764Highorg.a2aproject.sdk:a2a-java-sdk-server-common: A2A Java SDK has a fail-open default task authorizationCVE-2026-111763Mediumorg.a2aproject.sdk:a2a-java-sdk-parent: A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirectCVE-2026-112397HighPillow: Pillow: Out-of-bounds access in _imagingmorph on a zero-width imageCVE-2026-112400HighPillow: Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSCVE-2026-112899MediumPillow: Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limitCVE-2026-112897HighPillow: Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripsCVE-2026-112896HighPillow: Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readCVE-2026-112895Highpillow: Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)CVE-2026-112395Mediumpillow: Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)CVE-2026-112404HighPillow: Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelsCVE-2026-112403CriticalPillow: Pillow: Heap buffer overflow in ImagingJpegDecodeCVE-2026-111753Medium@angular/common: @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)CVE-2026-111758Highmarkdown-it: markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)CVE-2026-111766Lowmarkdown-it: markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabledCVE-2026-111770High@modelcontextprotocol/server: MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to anotherCVE-2026-111768High@modelcontextprotocol/sdk: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationCVE-2026-111748Mediumaiohttp: AIOHTTP: Absolute-form request targets can spoof Request.schemeCVE-2026-111749Lowaiohttp: AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesCVE-2026-111065Mediumaiohttp: AIOHTTP: Connector pool exhaustion via Max-Age overflowCVE-2026-111750Mediumaiohttp: AIOHTTP: Pure-Python parser request smugglingCVE-2026-111066Highaiohttp: AIOHTTP: File descriptor exhaustion in multipart requestsCVE-2026-112944Mediumlaunch-editor: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo