Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-GG6R-GP4C-89HPCriticaltrigger.dev: Trigger.dev: V1 coordinator default-secret unauth Socket.IOCVE-2026-77387Mediumgeopy: geopy: Regular Expression Denial of Service (ReDoS) in geopy.PointGHSA-5WF9-H793-W73CHighgithub.com/xtls/xray-core: Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacksGHSA-Q567-CR4X-96W4Mediumtrigger.dev: Trigger.dev: Blind SSRF via alert-channel webhookGHSA-PP95-GC86-JQ6QHightrigger.dev: Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)GHSA-XXV7-2VV3-H682Hightrigger.dev: Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URLGHSA-QXPP-QJG8-X4JVHightrigger.dev: Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)CVE-2026-59944Mediumcomposer/composer: Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin pathGHSA-8MCX-5RQC-VHMFHighdulwich: Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree PathsGHSA-35MR-4567-66VGMediumdulwich: Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object ResolutionGHSA-8W8G-WQ8H-FQ33Highdulwich: Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protectionsGHSA-5FQC-MRG8-W798Highdulwich: Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistenceGHSA-CM62-GVXX-VMXXHighdulwich: Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinksGHSA-6G2R-675J-HX59Lowxxhash-rust: xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in releaseCVE-2026-61586Higheu.copernik:copernik-xml-factory: Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolutionCVE-2026-62314Mediumgithub.com/TecharoHQ/anubis: Anubis: Policy bypass via client controlled X-Original-URI headerGHSA-C9XM-49CP-XCR9Mediumrmcp: rmcp OAuth client fetches server-controlled resource_metadata URLsCVE-2023-54404Highzod: Zod can exhaust memory while validating oversized constrained collectionsCVE-2026-73606Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents…GHSA-9CQF-HHRQ-7V45Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class…CVE-2026-73609Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filteringCVE-2026-73605Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over…CVE-2026-73607Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no…CVE-2026-92952Mediumvm2: vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checksCVE-2026-92948Criticalvm2: vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo