Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-92950Highvm2: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scriptsCVE-2026-92940Criticalvm2: vm2 exposes host HTTPS credentials and TLS traffic through globalAgentCVE-2026-92951Criticalvm2: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host PackageCVE-2026-92958Highvm2: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writesCVE-2026-92957Criticalvm2: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_processCVE-2026-92949Mediumvm2: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptorCVE-2026-92935Criticalvm2: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCECVE-2026-92937Criticalvm2: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirectionCVE-2026-92938Criticalvm2: vm2 allows a sandboxed plugin to execute native code through `node:sqlite`CVE-2026-92939Criticalvm2: vm2 crypto builtin loads attacker native code through setEngineCVE-2026-92944Criticalvm2: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protectorCVE-2026-92941Criticalvm2: vm2 NodeVM can replace the host process TLS trust storeCVE-2026-92945Mediumvm2: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlistedCVE-2026-102830Mediumjupyterlab: JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)CVE-2026-102904Mediumjupyterlab: JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLsCVE-2026-102831Highjupyterlab: JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboardCVE-2026-89425Highcom.fasterxml.jackson.core:jackson-core: jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89407Highcom.fasterxml.jackson.core:jackson-core: jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()CVE-2026-92708Highdevalue: devalue: `stringify`/`uneval` serialize shared memoryGHSA-HX4R-W6WJ-J8FGMediumdevalue: devalue: Residual sparse-array CPU amplification in unevalGHSA-MCM9-63F2-9J32Highdevalue: devalue: Repeated primitive strings cause quadratic expansion in unevalGHSA-WF3X-273G-MVXVLowdevalue: devalue: Sparse arrays emitted by uneval cause eager allocation when evaluatedGHSA-R9W8-H9R3-54W4Highdevalue: devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validationGHSA-X5RW-Q4PP-HG5GHighdevalue: devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promiseGHSA-4Q55-J62X-FR9HMediumdevalue: devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo