Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107301Mediummsgpack5: msgpack5: Partial options disable prototype protectionCVE-2026-107298Mediummsgpack5: msgpack5: Deeply nested input can exhaust the decoder stackCVE-2026-107297Mediummsgpack5: msgpack5: Quadratic parsing in the streaming decoderCVE-2026-107296Lowmsgpack5: msgpack5: Decoding negative int64 values mutates the input bufferCVE-2026-60090Mediumpraisonai: PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLCVE-2026-107292Mediumpydantic-ai: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` headerCVE-2026-107295Highpydantic-ai: Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool…CVE-2026-107293Lowpydantic-ai: Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`CVE-2026-107294Mediumpydantic-ai: Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlCVE-2026-107212Highgithub.com/xuri/excelize/v2: Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for daysCVE-2026-107213Highgithub.com/xuri/excelize/v2: Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing elementCVE-2026-107228Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)CVE-2026-107226Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSCVE-2026-107227Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is…CVE-2026-107230Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsCVE-2026-61443Highpraisonaiagents: PraisonAI: SkillTools Executes Scripts Without Path Containment ValidationCVE-2026-61437Highpraisonaiagents: PraisonAI: Unsafe Dynamic Module Loading Leads to Arbitrary Code Execution via tools.py in AgentFlowCVE-2026-61432Mediumpraisonaiagents: PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspaceCVE-2026-107290Mediumpydantic-ai: Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch`CVE-2026-107291Lowpydantic-ai: Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`CVE-2026-107289Mediumpydantic-ai: Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiersCVE-2026-61446Highpraisonaiagents: PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without VerificationCVE-2026-61447Criticalpraisonaiagents: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment SecretsCVE-2026-60087Mediumpraisonaiagents: PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary argumentsCVE-2026-61430Highpraisonaiagents: PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo