Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-113655Mediumapostrophe: ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationCVE-2026-113666High@apostrophecms/db-connect: ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of…CVE-2026-113654Mediumsanitize-html: ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content renderCVE-2026-111756Highfollow-redirects: follow-redirects array-form headers bypass cross-origin credential strippingCVE-2026-111755Highfollow-redirects: follow-redirects sensitiveHeaders regex escaping can expose credential headersCVE-2026-111751High@angular/router: @angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)CVE-2026-111752High@angular/router: @angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)CVE-2026-111757Mediumhono: Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsCVE-2026-111754Medium@angular/platform-server: @angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)CVE-2026-111759Highmarkdown-it: markdown-it: Quadratic complexity in smartquotes with unmatched closing quotesCVE-2026-63209Highgithub.com/klauspost/compress: Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compressCVE-2026-61845Highcrass: Crass : Large numeric exponents cause CPU and memory denial of serviceCVE-2026-53995Highmlflow: MLflow FileStore trace IDs allow path traversal and arbitrary file writesCVE-2026-111064Highaiohttp: aiohttp server lacks an initial request/header timeoutCVE-2026-111063Mediumaiohttp: AIOHTTP: Secure attribute not enforced for shared cookieGHSA-2G87-PP6C-29X5Highaiohttp: aiohttp: Multiple instances of excessive or unbounded memory/CPU useCVE-2026-111061Mediumrussh: russh: Unbounded memory allocation in agent protocol server via crafted constraint recordsCVE-2026-111062Lowrussh: A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the requestCVE-2026-111059Mediummercury: Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLCVE-2026-111057Criticalmercury: Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypassGHSA-953H-535J-JG2VMediumgithub.com/envoyproxy/ai-gateway: agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeableGHSA-PCC4-RVHR-2PR8Mediumgraphifyy: Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repoCVE-2026-111058Criticalmercury: Mercury: Unauthenticated Remote Code Execution via /api/kernelsCVE-2026-108372Highloopx: LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown filesCVE-2026-96627Highgithub.com/getarcaneapp/arcane/backend/v2: Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo