Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-76844Highwebpack-dev-middleware: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPathGHSA-6VJ9-MWQ6-2F5VMediumnodemailer: Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosureCVE-2026-85024Mediumundici: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionCVE-2026-88932Mediummulter: multer vulnerable to Denial of Service via orphaned disk writes on aborted uploadsCVE-2026-87859Mediummorgan: morgan vulnerable to Log Injection via unescaped double quote in quoted log fieldsCVE-2026-101895High@angular/platform-server: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPECVE-2026-84292Highfast-uri: fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84394Highfast-uri: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityCVE-2026-83557Mediumtools.jackson.core:jackson-databind: jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator…CVE-2026-101913Mediumip-address: ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsCVE-2026-101910Mediumip-address: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypassCVE-2026-88058High@angular/platform-server: Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content ElementsCVE-2026-68497Hightools.jackson.core:jackson-databind: jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-19032Mediumtools.jackson.core:jackson-databind: jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-77310Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-101914Medium@grpc/grpc-js-xds: @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesCVE-2026-61834Mediumscim-patch: scim-patch: Mutation of Inherited Built-in Method ObjectsGHSA-456V-XQ2P-R4CJHighcode-ollama: code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)CVE-2026-57443Highscbe-aethermoore: SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email DigestsCVE-2026-100368HighCliInvoke.Specializations: CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappersCVE-2026-100369HighCliInvoke: CliInvoke: Argument Injection in Extensibility Runner FactoryGHSA-62MM-XWMV-CRHGHighkhoj: khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo