Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-2MJX-QC3C-RQVCMediumrustls: Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundariesCVE-2026-104859High@nx/docker: @nx/docker: OS command injection in the @nx/docker release pipelineGHSA-W2VW-W76X-QR89Highnx: Nx: OS command injection via git revisions and remote refsCVE-2026-104854Highnx: Nx daemon and plugin worker sockets are accessible to other local usersCVE-2026-104853Mediumnx: Nx: Path traversal in nx migrate package-migrations extractionCVE-2026-87776Highcompression: compression vulnerable to Denial of Service via memory leak on premature response closeGHSA-G7FW-3GJP-G5HFMedium@openclaw/msteams: OpenClaw: Channel read actions could skip target allowlistsCVE-2026-88029Mediumpymongo: pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methodsCVE-2026-88023Mediummongodb/mongodb: MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDsCVE-2026-100721Criticalvm2: vm2: NodeVM custom resolution bypasses external path boundariesCVE-2026-100722Highvm2: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host processCVE-2026-100723Mediumvm2: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundaryCVE-2026-103921High@graphql-tools/executor-legacy-ws: GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket ExecutorCVE-2026-104852High@graphql-tools/utils: GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`CVE-2026-86597Mediumsnowflake-sdk: Snowflake drivers writes sensitive information to logsGHSA-6F2X-V7Q7-M7M5Mediumhickory-resolver: hickory-resolver follows irrelevant CNAME recordsGHSA-6W6G-HM98-MHGMHighhickory-resolver: hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)GHSA-5J98-2G5X-46V6Highhickory-resolver: hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failuresCVE-2026-104844Mediumpostcss-selector-parser: PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustionCVE-2026-104871Medium@angular/ssr: Angular SSR: Path Traversal to Sibling Directories in CommonEngine on WindowsCVE-2026-104851Highfsspec: fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code ExecutionCVE-2026-103922Critical@capacitor/android: Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathCVE-2026-104872Medium@opentelemetry/instrumentation-cassandra-driver: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributeGHSA-JGGR-W7FW-PC2JMediumfast-copy: fast-copy: Stack exhaustion in fast-copy when copying deeply-nested valuesGHSA-G2V6-RQMX-R4W6High@vue/server-renderer: @vue/server-renderer: XSS via missing CR in attribute-name blacklist

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo