Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-104848Criticaltinypool: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code ExecutionCVE-2026-104849Criticaltinypool: Tinypool: Prototype Pollution Gadget to RCE in run() optionsGHSA-V853-P72Q-4CFWHighquart: Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__CVE-2026-104873Highlanggraph-sdk: LangGraph SDK custom auth silently ignores actions= on resource decoratorsCVE-2026-104182Mediumstream-json: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunkCVE-2026-104183Mediumstream-json: stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objectsCVE-2026-92959Highvm2: vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVMCVE-2026-92955Criticalvm2: vm2: Sandbox Escape (NodeVM)CVE-2026-92954Criticalvm2: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host processCVE-2026-92953Criticalvm2: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fixCVE-2026-92934Criticalvm2: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuitCVE-2026-92933Mediumvm2: vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stackCVE-2026-104847Highprosemirror-view: ProseMirror has a XSS vulnerability in prosemirror-view's paste handlingCVE-2026-92936Mediumvm2: vm2 leaks absolute host filesystem paths to sandbox code via error stack formattingCVE-2026-92942Highvm2: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)CVE-2026-92946Criticalvm2: vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCECVE-2026-92947Criticalvm2: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer poolCVE-2026-92956Criticalvm2: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypassCVE-2026-105751Mediumdocling: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backendCVE-2026-74866Medium@fastify/busboy: @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and nameCVE-2026-9205Criticallangflow: Langflow: Weak Fernet Key via random.seed()CVE-2026-8505Criticallangflow: Langflow: Unauthenticated Flow Execution via Webhook Authentication BypassCVE-2026-51886Highlangflow: Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators DescriptionCVE-2026-7700Highlangflow: Langflow: Prompt injection in Langflow Smart Transform can lead to code executionGHSA-4WWP-F6GW-6QM5Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo