Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-17495Mediummoment: moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-102277Mediumbrace-expansion: brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102278Highbrace-expansion: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102276Highbrace-expansion: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102599Highengine.io: Socket.IO: Engine.IO Protocol Revision Mismatch DoSGHSA-G57G-F23G-4646Mediumnodemailer: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsingGHSA-V53P-9FQP-M79JHighnodemailer: Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of serviceCVE-2026-102266HighPyJWT: PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationCVE-2026-102265MediumpyJWT: PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerCVE-2026-102269MediumPyJWT: PyJWT: Non-canonical signature segments enable raw-token revocation bypassCVE-2026-102268CriticalPyJWT: PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardCVE-2026-102273HighPyJWT: PyJWT accepts public JWK containers as HMAC secretsCVE-2026-102267HighPyJWT: PyJWT: PyJWKClient follows redirects when fetching JWKSCVE-2026-102271Highpyjwt: PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardCVE-2026-102272HighPyJWT: PyJWT BOM BypassCVE-2026-101917Mediumpyjwt: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)GHSA-P634-W6R4-RJP2Mediumadm-zip: adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different contentGHSA-C6FG-446Q-CG94Mediumadm-zip: adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() pathGHSA-8238-W5PM-2374Highadm-zip: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)CVE-2026-102342Mediumammonia: Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')GHSA-RCW4-F5RP-G42VHighadm-zip: adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0CVE-2026-102282Highadm-zip: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationCVE-2026-102279Lowlaravel/framework: Laravel: XSS in Debug Page InformationGHSA-8VVX-RFF5-P5RQMediumnodemailer: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoSCVE-2026-102274MediumPyJWT: PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo