Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-79674Highnltk: NLTK: Corpus Reader Sandbox BypassCVE-2026-79676Highnltk: NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcementCVE-2026-79657Criticalnltk: NLTK: Allowlisted pickle loaders still permit code execution in current sourceCVE-2026-78681Highnltk: NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parsesCVE-2026-78682Highnltk: NLTK: pathsec SSRF protection can be bypassed when a proxy is configuredCVE-2026-78683Criticalnltk: NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code ExecutionCVE-2026-62383Mediumnltk: NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirelyCVE-2026-62384Highnltk: NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)CVE-2026-62385Highnltk: NLTK: Stable FrameNet and NKJP readers parse outside-root XMLCVE-2026-12259Mediumnltk: NLTK: Missing Post-Download Integrity Verification Allows Malicious Package InjectionCVE-2026-63312Highnltk: NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File ReadCVE-2026-65915Mediumnltk: NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocolCVE-2026-70626Highnltk: NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus rootCVE-2026-76969Critical@sap/cds-mtxs: @sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)GHSA-7Q9C-HPX7-9CWMHigh@typespec/spector: TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stopCVE-2026-73842Criticalgithub.com/openchoreo/openchoreo: OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and…CVE-2026-73557Mediumvllm: vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt partsCVE-2026-73556Mediumvllm: vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2mCVE-2026-73555Mediumvllm: vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error MessagesCVE-2026-71486Mediumvllm: vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output boundsCVE-2026-72792Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the passwordCVE-2026-72793Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips,…CVE-2026-72795Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document…CVE-2026-72794Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConfCVE-2026-72796Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo