Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-84452Highwinml-cli: Windows ML CLI: CORS misconfig enables localhost RCE CVE-2026-81525Highmongodb/mongodb: mongodb: Reject "." and NUL bytes in database and collection names GHSA-26W7-CXV4-GFX2Criticalastro: Astro: Remote code execution through AVIF image optimization CVE-2026-84376Mediumastro: Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base CVE-2026-84361Highcomposer/composer: Composer arbitrary command execution via a malicious package's Perforce source URL GHSA-RGJ7-G3M4-5G8CHighsharp: sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 CVE-2026-84375Highjs-yaml: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources CVE-2026-84308Mediumphpseclib/phpseclib: phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery GHSA-J95F-988M-3J2FHigh@tiptap/core: Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing CVE-2026-84365Mediumhono: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory CVE-2026-84364Mediumhono: Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion CVE-2026-84363Mediumhono: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials CVE-2026-84445Highgoogle.golang.org/grpc: gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers GHSA-2XP9-VWFH-VXW4Criticalnext: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used CVE-2026-84370Highsvgo: SVGO: removeScripts allows executable links through namespace and control-character bypasses CVE-2026-84369Mediumsvgo: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements GHSA-8M3C-C648-2XJJMediumnodemailer: Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature CVE-2026-83616High@xmldom/xmldom: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVE-2026-83617High@xmldom/xmldom: xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVE-2026-83608High@xmldom/xmldom: xmldom: DocType `name` Injection Bypasses requireWellFormed CVE-2026-83609High@xmldom/xmldom: xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default…CVE-2026-83618High@xmldom/xmldom: xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVE-2026-83611Medium@xmldom/xmldom: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content CVE-2026-83613High@xmldom/xmldom: xmldom: Quadratic-time attribute deduplication CVE-2026-83619High@xmldom/xmldom: xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo