Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-105846Mediumpayload: Payload: Untrusted redirect URL parameter exploitCVE-2026-105847Highpayload: Payload: Polymorphic join queries could disclose hidden fieldsCVE-2026-105804Mediumpayload: Payload: Password hashes use insufficient PBKDF2 iterationsCVE-2026-105805Mediumpayload: Payload: Sort queries could expose protected field informationCVE-2026-105795LowMicrosoft.OpenApi.Kiota: Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifestsCVE-2026-105796HighMicrosoft.OpenApi.Kiota: Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generatorsCVE-2026-104850High@modelcontextprotocol/sdk: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverCVE-2026-105800Lowi18next-http-backend: i18next-http-backend incomplete URL validation permits SSRFCVE-2026-105794CriticalMicrosoft.Native.Quic.MsQuic.OpenSSL: MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSLCVE-2026-105801Highopenapi-python-client: openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code GenerationCVE-2026-105799Low@langchain/redis: LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesCVE-2026-26287Highgithub.com/external-secrets/external-secrets: External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltrationGHSA-2R3X-4MRV-MCXFMediumvyper: Vyper: Memory corruption using function calls within tuples / nested callsGHSA-4V7V-GQF9-WW2GMediumvyper: Vyper: Call stack corruption when passing complex type containing non-base type members as argumentGHSA-VG88-3V92-RJX2Mediumvyper: Vyper: Return inside for loop more than 1 level deepGHSA-WQ5F-XC86-PV6WHighsharp: sharp : Vulnerability in librsvg dependency CVE-2026-96889CVE-2026-105747Mediumdocling: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)CVE-2026-102422Criticalshell-quote: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokenCVE-2026-102414Mediumpbkdf2: pbkdf2 rehashes long passwords on every iteration, enabling denial of serviceGHSA-J8F7-X8JM-WMM4Mediumlangflow: Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home…CVE-2026-10561Criticallangflow: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalationCVE-2026-105750Mediumdocling: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering modeCVE-2026-105753Mediumvllm: vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver…CVE-2026-105752Lowvllm: vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracleCVE-2026-102598MediumWerkzeug: Werkzeug safe_join() allows Windows special device names

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo