Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-116581Highseroval: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)CVE-2026-116584Highseroval: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthCVE-2026-116580Highseroval: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checkCVE-2026-116575Mediummem0ai: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)CVE-2026-115910Mediumsocial-auth-core: Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the…CVE-2026-115920Mediumonnx: ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rankCVE-2026-115922Mediumonnx: ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIsCVE-2026-115921Mediumonnx: ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required AttributeCVE-2026-115919Mediumonnx: ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)CVE-2026-115917Lowvllm: vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP serverCVE-2026-115913Mediumvllm: vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engineCVE-2026-115914Mediumvllm: vLLM DeepSeek-OCR image processing vulnerable to denial of serviceCVE-2026-115915Highvllm: vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCECVE-2026-115912Highvllm: vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabledCVE-2026-115916Mediumvllm: vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)CVE-2026-115918Mediumvllm: vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargsCVE-2026-115911Mediumvllm: vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread poolCVE-2026-115893Criticalwasmtime: Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instructionCVE-2026-116586Mediumgithub.com/go-jose/go-jose/v4: Go JOSE: Panics in JSON parsingCVE-2026-116585Mediumgithub.com/go-jose/go-jose/v4: Go JOSE: Panic during CBC-HMAC processingCVE-2026-116673Lowsysteminformation: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/netCVE-2026-116674Mediumsysteminformation: systeminformation has prototype pollution in `networkStats()` via the interface nameCVE-2026-115885Mediumlanggraph-cli: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputCVE-2026-115887Highgraphql-scalars: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of serviceCVE-2026-116579Mediumautobahn: Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo