Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-60089Mediumpraisonaiagents: PraisonAI: Project config can auto-save agent output outside the project rootCVE-2026-107214Highgithub.com/xuri/excelize/v2: Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooksCVE-2026-107215Highgithub.com/xuri/excelize/v2: Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoSCVE-2026-107216Highgithub.com/xuri/excelize/v2: Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflowCVE-2026-107283Loworg.asynchttpclient:async-http-client: AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceCVE-2026-107285Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnelCVE-2026-107280Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukCVE-2026-107282Criticalorg.asynchttpclient:async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostCVE-2026-107231Highorg.asynchttpclient:async-http-client: AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartextCVE-2026-61801Mediumgithub.com/moby/sys/user: github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61439HighPraisonAI: PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level ThreatsCVE-2026-105642Highghost: Ghost: Remote Code Execution via Bookmark Card ImagesCVE-2026-105643Highghost: Ghost: Stored XSS via Embed Card PreviewsCVE-2026-105644Mediumghost: Ghost : Stored XSS via SVG Files in Content ImportsCVE-2026-105645Mediumghost: Ghost: Regular Expression Denial of Service in External Media InlinerCVE-2026-105646Mediumghost: Ghost: Regular Expression Denial of Service in Content ImportCVE-2026-106121Mediumcom.rabbitmq:amqp-client: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoSCVE-2026-105742Lowdocling: Docling: Configured HTTP headers sent to every remote image host named by a documentCVE-2026-105743Mediumdocling: Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)CVE-2026-105744Highdocling: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in…CVE-2026-105748Mediumdocling: Docling: Crafted DoclingDocument JSON embeds local image files into converted outputCVE-2026-105749Mediumdocling: Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustionCVE-2026-105745Mediumdocling: Docling imports plugin entry points before the allow_external_plugins checkCVE-2026-105697Criticallangflow: Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configurationCVE-2026-105698Mediumlangflow: Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo