Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-102829Critical@simple-git/argv-parser: simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detectionCVE-2026-102828Criticalsimple-git: simple-git unsafe-operation guard does not block trailer command configurationCVE-2026-102826Highsimple-git: simple-git allows command execution through unblocked Git configuration includesCVE-2026-102827Highsimple-git: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of…CVE-2026-96749Highpymongo: PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encodingCVE-2026-96748Highpymongo: PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimitersCVE-2026-96747Mediumpymongo: PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryptionCVE-2026-102600High@socket.io/cluster-engine: Socket.IO: Prototype Pollution via Unsafe Client Session LookupCVE-2026-104181Mediumfilament/filament: Filament: Multi-factor authentication (app) management actions do not require password reauthenticationCVE-2026-102275MediumPyJWT: PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionGHSA-6688-9RHM-GJV2Lowdompurify: DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executesCVE-2026-105758Mediumvllm: vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reachCVE-2026-105760Mediumvllm: vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustionCVE-2026-105754Mediumvllm: vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied featuresCVE-2026-105757Mediumvllm: vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3…CVE-2026-105755Mediumvllm: vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and…CVE-2026-105756Mediumvllm: vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError`…CVE-2026-104843Mediumuv: uv: Path traversal on Windows through wheel extractionCVE-2026-102991MediumMako: Mako: Path traversal via drive-letter URI on Windows in TemplateLookupGHSA-R4XH-JQRQ-34V2Mediumsmol-toml: smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key lineCVE-2026-103923Lowkatex: KaTeX: Existing prototype pollution can bypass trust restrictionsCVE-2026-104874Mediummultidict: Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionCVE-2026-104846Criticalseroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)CVE-2026-104845Highseroval: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationCVE-2026-90711Criticalproxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo