Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-102925Highvirtualenv: virtualenv bash and fish activation scripts execute commands embedded in pathsCVE-2026-102937Highvirtualenv: virtualenv: Command injection via --prompt in activate.bat (batch activator)CVE-2026-102999Highpypdf: pypdf: Possible long runtimes with large amount of embedded filesCVE-2026-102998Highpypdf: pypdf: Possible long runtimes when generating appearance streamsCVE-2026-103000Highpypdf: pypdf: Possible large memory usage when retrieving alphabetical page labelsCVE-2026-102997Highpypdf: pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)CVE-2026-102996Highpypdf: pypdf: Possible large memory usage when parsing font dataCVE-2026-102995Highpypdf: pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)CVE-2026-102994Highpypdf: pypdf: Possible long runtimes/large memory usage when parsing indirect objectsCVE-2026-102993Highpypdf: pypdf: Possible large memory usage when retrieving Roman page labelsCVE-2026-102992Criticalpiscina: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / envCVE-2026-102990Highbasic-ftp: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)CVE-2026-72788Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan discloses an administrator's open documents and search terms to anonymous readersCVE-2026-69085Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stackingCVE-2026-102930Highvirtualenv: virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before useCVE-2026-102938Mediumvirtualenv: virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injectionCVE-2026-92081Mediumfastify: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responsesCVE-2026-103001MediumPyJWT: PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseGHSA-3HV7-MJH2-FV65Mediumtornado: Tornado: Unbounded query-string argument count allows event-loop-stalling DoSGHSA-CHX6-46F5-W4VPHightornado: tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOMGHSA-C2M8-H5V5-343RHightornado: Tornado: StaticFileHandler follows symlinks outside static root (path traversal)GHSA-59CR-6R3X-644WMediumGitPython: GitPython submodule update path traversal can write outside the repositoryCVE-2026-93981Mediumhono: hono/jsx renders plain strings unescaped in boundary components, leading to XSSCVE-2026-84504Highfastify: fastify vulnerable to request body replacement via an async validation result collisionCVE-2026-76169Highfastify: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo