Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-119200Mediumnuxt: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesCVE-2026-119198Medium@nuxt/vite-builder: Nuxt dev server arbitrary file read through client error reportsCVE-2026-119199Medium@nuxt/vite-builder: Nuxt dev server exposes private runtime config through the Nitro dev bundleCVE-2026-118763High@sigstore/oci: @sigstore/oci sends the registry Authorization header to a cross-host blob-upload LocationCVE-2026-119276Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packetsCVE-2026-119279Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengthsCVE-2026-119280Loworg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengthsCVE-2026-119210Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server…CVE-2026-119281Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticingCVE-2026-116689Highfollow-redirects: follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirectsCVE-2026-116794Highrussh: russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmationCVE-2026-116775Lowpageant: pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)CVE-2026-116774Mediumrussh: russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)CVE-2026-116696Lowrussh: russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messagesCVE-2026-116773Mediumrussh: russh's SSH client is susceptible to unbounded allocations via EXT_INFO packetsCVE-2026-119286Highgraphql-core: GraphQL-core has denial of service via memory leak in aborted validationsCVE-2026-118669Highoauthlib: OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientCVE-2026-116677Mediumopenwisp-controller: OpenWISP Controller CA CRL REST API does not scope requests to managed organizationsCVE-2026-119285Mediumgithub.com/gofiber/fiber/v2: Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readsGHSA-7WPF-CH8F-5F4XMediumsignalk-server: signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcherGHSA-4XM8-RG9H-JHQ2Criticalsignalk-server: Signal K resources API path traversal can disclose the JWT signing secret and enable remote code executionGHSA-HFF9-5PQW-6W9FCriticalgithub.com/imgproxy/imgproxy/v3: imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code executionGHSA-494M-4556-WF5PHighgithub.com/imgproxy/imgproxy/v3: imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crashGHSA-MMQ5-XM89-9PFGHighgithub.com/imgproxy/imgproxy/v3: imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size fieldGHSA-2WRX-84QJ-4PCGMediumgithub.com/anacrolix/torrent: anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo