Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-61433Highpraisonai: PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source CVE-2026-61435Highpraisonai: PraisonAI: Call API localhost-only authentication bypass via spoofed Host header CVE-2026-61431Mediumpraisonai: PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace CVE-2026-107377Highdatamodel-code-generator: datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory CVE-2026-60088Mediumpraisonai: PraisonAI: Project custom command templates can read outside-workspace files into model prompts CVE-2026-106444Mediumhandlebars: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates CVE-2026-106446Criticalhandlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)CVE-2026-106445Criticalhandlebars: Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106119Medium@langchain/mongodb: LangChain: MongoDBChatMessageHistory query injection can allow cross-session access CVE-2026-107211Highgithub.com/xuri/excelize/v2: Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic CVE-2026-107834Mediumgithub.com/corazawaf/coraza/v3: Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor GHSA-W253-M66G-RX24Mediumgithub.com/corazawaf/coraza/v3: Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection CVE-2026-107833Mediumgithub.com/corazawaf/coraza/v3: Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion GHSA-3WR7-993Q-JRFFMediumgithub.com/corazawaf/coraza/v3: Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules GHSA-G4QM-M288-5CP9Mediumgithub.com/corazawaf/coraza/v3: Coraza has Cookie Parser Confusion CVE-2026-107825Mediumgithub.com/corazawaf/coraza/v3: Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations CVE-2026-104774Mediumgithub.com/corazawaf/coraza/v3: Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass CVE-2026-107826Highgithub.com/corazawaf/coraza/v3: Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash)GHSA-5GJ4-9GM7-2FX2Mediumgithub.com/corazawaf/coraza/v3: Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection CVE-2026-107287Mediumpydantic-ai: Pydantic AI: Excessive resource use when local web fetching converts nested HTML CVE-2026-107375Highgenerator-jhipster: JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort CVE-2026-107303Highgenerator-jhipster: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob CVE-2026-107302Highmsgpack5: msgpack5: Truncated map32 headers throw an unexpected error CVE-2026-107300Highmsgpack5: msgpack5: Many buffered values can exhaust the streaming decoder stack CVE-2026-107299Mediummsgpack5: msgpack5: Reserved byte can cause unbounded stream buffering

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo