Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-84469Highfastify: fastify vulnerable to request validation bypass via skipped boolean false schemasCVE-2026-84428Highfastify: fastify vulnerable to header validation bypass via incomplete schema case normalizationCVE-2026-102820Mediumpageant: pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)CVE-2026-102821Mediumrussh: Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekeyCVE-2026-102983Medium@astrojs/netlify: Astro: Netlify Image CDN allowlist bypass enables SSRFCVE-2026-102984High@astrojs/node: Astro: Malformed port in the Host header can crash the Node adapterCVE-2026-87819HighGitPython: GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsingGHSA-WHH4-5Q6C-9V3XMediumgitpython: GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracleCVE-2026-87817Highgitpython: GitPython: Repository content can impersonate the git directory, leading to arbitrary code executionCVE-2026-102822Lowrussh: russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panicCVE-2026-102823Highrussh: russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedCVE-2026-102824Mediumrussh: Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchangeCVE-2026-102825Lowrussh: Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime pathCVE-2026-84377Mediumlitellm: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersCVE-2026-101918MediumPyJWT: PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)CVE-2026-101896High@angular/router: Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix ParametersCVE-2026-97711Lowserialize-javascript: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodiesGHSA-P98J-92PF-MC4PLowdompurify: DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSSCVE-2026-91777Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind quadratic forward-reference completion CVE-2026-91776Highcom.fasterxml.jackson.core:jackson-databind: jackson-databind retains every unknown raw type ID GHSA-97JJ-33GV-5XF9Mediumleague/commonmark: league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literalGHSA-3Q6V-R5MR-HXV8Highleague/commonmark: league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scanCVE-2026-101916High@grpc/grpc-js: @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorizedCVE-2026-101915Low@grpc/grpc-js: @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messagesCVE-2026-101904Mediumaxios: Axios: Header Injection via Inherited headers After Minimal Interceptor

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo