Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-118258Lowi18next-http-backend: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringCVE-2026-116795Highre2js: RE2JS: Quadratic-time denial of service in re2js lookbehind matchingCVE-2026-115905Criticalzip: zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…CVE-2026-118668Highlanggraph-api: LangGraph JavaScript custom authentication may permit cross-user Store accessCVE-2026-112941Lowfilelock: filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user…CVE-2026-112908Mediumfilelock: filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a…CVE-2026-112911Mediumfilelock: filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionCVE-2026-112910Mediumfilelock: filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACLCVE-2026-112915Mediumfilelock: filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutCVE-2026-112939Mediumfilelock: filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerCVE-2026-112912Lowfilelock: filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerCVE-2026-112909Mediumfilelock: filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathCVE-2026-112936Mediumfilelock: filelock: ReadWriteLock follows a symlink at the lock path into SQLiteCVE-2026-112938Mediumfilelock: filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local…CVE-2026-112934Mediumfilelock: filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its…CVE-2026-112935Mediumfilelock: filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersCVE-2026-115730Lowi18next-http-backend: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a /…CVE-2026-118259Mediumio.opentelemetry:opentelemetry-api: opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsingCVE-2026-118660Highhappy-dom: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLCVE-2026-118256Lowvue-i18n: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listCVE-2026-118257Highvue-i18n: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesCVE-2026-118661Mediumhappy-dom: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiesCVE-2026-118667Mediumlanggraph-sdk: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsCVE-2026-118665High@graphql-tools/executor-legacy-ws: GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsCVE-2026-118666Medium@graphql-tools/executor-legacy-ws: GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo