Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-18149Mediumundici: undici vulnerable to Denial of Service via orphaned RetryHandler response body CVE-2026-18540Lowundici: undici vulnerable to downstream response splitting via retry interceptor CVE-2026-19534Highundici: undici vulnerable to Denial of Service via unrequested WebSocket subprotocol CVE-2026-84890Mediumundici: undici vulnerable to Denial of Service via unbounded decompression of compressed responses CVE-2026-84933Mediumundici: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches CVE-2026-84947Lowundici: undici vulnerable to response truncation via oversized chunked responses in the dump interceptor CVE-2026-84961Highundici: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool CVE-2026-85008Lowundici: undici vulnerable to caching and replay of unsafe HTTP method responses CVE-2026-85152Highundici: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors CVE-2026-85014Mediumundici: undici vulnerable to Denial of Service via WebSocketStream unclean close CVE-2026-102601Lowleague/flysystem: Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting…CVE-2026-92599Highjoi: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`CVE-2026-102672Mediumelectron: Electron: Local race condition in Squirrel.Mac update installation on macOS CVE-2026-102673Highelectron: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab CVE-2026-102674Highelectron: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions CVE-2026-102675Highelectron: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled CVE-2026-102676Highelectron: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions CVE-2026-102677Highelectron: Electron: Sandboxed preload code cache can be poisoned by a compromised renderer CVE-2026-81872Mediumgo.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full CVE-2026-81869Mediumgo.opentelemetry.io/otel/sdk: OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation GHSA-253C-MCHW-3W2RMediummarkdown-it: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds GHSA-R3PH-W7GJ-G6XMMediumjs-yaml: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources CVE-2026-65954Highphpcsstandards/phpcsutils: PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()CVE-2026-49265Mediumoauthlib: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)CVE-2026-49264Mediumoauthlib: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo