Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-80206Highnltk: NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressionsCVE-2026-80205Highnltk: NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressionsCVE-2026-62815CriticalMicrosoft.Native.Quic.MsQuic.OpenSSL: Microsoft QUIC: Remote Code Execution VulnerabilityCVE-2026-62900MediumMicrosoft.Build.Tasks.Git: Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure VulnerabilityCVE-2026-73558Mediumvllm: vLLM: Cross-User Data Leak VulnerabilityCVE-2026-78679MediumGitPython: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of…CVE-2026-78677HighGitPython: GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside…CVE-2026-78678MediumGitPython: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()CVE-2026-78676CriticalGitPython: GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated…CVE-2026-78675HighGitPython: GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables…CVE-2026-82533Critical@deepseek-ai/dsh-client-connection: DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane APICVE-2026-75595Criticalio.netty:netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContextCVE-2026-75596Mediumio.netty:netty-handler: Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsingCVE-2026-71494Mediumgithub.com/infracost/infracost: Infracost: Terraform Cloud and registry token disclosure via unvalidated hostnameCVE-2026-71493Mediumgithub.com/infracost/infracost: Infracost: Arbitrary file read via config-template readFile symlink traversalCVE-2026-73087Lowgithub.com/amir20/dozzle: Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcherCVE-2026-69222Highliquidjs: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the processCVE-2026-73262Mediumprowler: Prowler: Stored XSS in HTML reports through unescaped cloud resource tagsCVE-2026-85063Mediumcsv-parse: node-csv: Prototype replacement still reachable via columns pathCVE-2026-72925Medium@swc/html: SWC HTML minifier may allow script element breakout when minifying embedded JSONCVE-2026-73294Criticalgithub.com/semaphoreui/semaphore: Semaphore U: OS Command InjectionCVE-2026-60004Criticalgitea.dev: Gitea: Remote Code Execution via diffpatch Git Hook InstallationCVE-2026-72789Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully…CVE-2026-72790Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by…GHSA-57V5-WQX3-CGJ4Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo