Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-106101Lowquasar: Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service CVE-2026-107217Highgithub.com/xuri/excelize/v2: Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0"…CVE-2026-107218Mediumgithub.com/xuri/excelize/v2: Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics CVE-2026-107219Highgithub.com/xuri/excelize/v2: Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile CVE-2026-107220Mediumgithub.com/xuri/excelize/v2: Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref CVE-2026-107221Mediumgithub.com/xuri/excelize/v2: Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet…CVE-2026-107222Mediumgithub.com/xuri/excelize/v2: Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check CVE-2026-107223Highgithub.com/xuri/excelize/v2: Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator…CVE-2026-107224Mediumgithub.com/xuri/excelize/v2: Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader CVE-2026-107225Mediumgithub.com/xuri/excelize/v2: Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml CVE-2026-61429Highpraisonaiagents: PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass CVE-2026-106443HighWeasyPrint: WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE CVE-2026-104890Highkunstmaan/media-bundle: Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote…CVE-2026-105680Mediumghost: Ghost: Authorization Issue Allowed Author Role to Delete any Post CVE-2026-93605Criticalvm2: vm2 contains a sandbox escape vulnerability CVE-2026-106441Highhydra-core: Hydra logging configuration permits unsafe callable resolution CVE-2026-106442Highhydra-core: Hydra instantiate target blacklist bypasses permit code execution CVE-2026-104891High@insumermodel/mppx-condition-gate: mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control CVE-2026-106510High@backstage/plugin-techdocs-node: Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml CVE-2026-106558High@backstage/plugin-techdocs-node: Backstage: Improper validation of TechDocs MkDocs configuration CVE-2026-106559Medium@backstage/plugin-scaffolder-backend-module-confluence-to-markdown: Backstage: Improper input validation in Confluence to Markdown scaffolder module CVE-2026-106560High@backstage/plugin-scaffolder-backend-module-confluence-to-markdown: Backstage: Improper repository path validation in a Scaffolder backend module CVE-2026-106562Medium@backstage/plugin-search-backend: Backstage has incorrect authorization in search engine permission filtering CVE-2026-106563Medium@backstage/plugin-kubernetes-backend: Backstage: Improper entity validation in deprecated Kubernetes services endpoint CVE-2026-106561Medium@backstage/plugin-kubernetes-backend: Backstage has a sensitive information disclosure in Kubernetes resource queries

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo