Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-118663Medium@hono/node-server: @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths CVE-2026-118657Mediumgithub.com/labstack/echo/v5: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers CVE-2026-118654Mediumgithub.com/labstack/echo/v5: Echo static file middleware route protection bypass via encoded dot-dot traversal CVE-2026-118655Mediumgithub.com/labstack/echo/v5: Echo has a Static Middleware Double-Unescape Path Traversal CVE-2026-118656Mediumgithub.com/labstack/echo/v5: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI CVE-2026-118658Mediumgithub.com/labstack/echo/v5: Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto CVE-2026-118255High@highcharts/dashboards: Highcharts Grid: `javascript:` URL in credits.href runs script on click CVE-2026-118254High@highcharts/grid-lite: Highcharts Grid parses pagination language options as HTML CVE-2026-118253High@highcharts/dashboards: Highcharts Dashboards parses fullscreen labels as HTML CVE-2026-118252High@highcharts/dashboards: Highcharts Dashboards parses sidebar component labels as HTML CVE-2026-118251Highhighcharts: Highcharts: `javascript:` URL in credits.href runs script on click CVE-2026-118250Highhighcharts: Highcharts: dotted series.keys paths write to Object.prototype CVE-2026-118249Highhighcharts: Highcharts: series column construction writes to Object.prototype CVE-2026-118246Highhighcharts: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes CVE-2026-116797High@highcharts/grid-pro: Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`CVE-2026-118242High@highcharts/grid-lite: Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`CVE-2026-118245High@highcharts/dashboards: Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace CVE-2026-118247Medium@highcharts/dashboards: Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.CVE-2026-118243Medium@highcharts/dashboards: Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`CVE-2026-118244Highhighcharts: Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing CVE-2026-116796Highhighcharts: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts CVE-2026-118650Highgithub.com/labstack/echo/v5: Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path CVE-2026-118652Mediumgithub.com/labstack/echo/v5: Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob CVE-2026-118653Mediumgithub.com/labstack/echo/v5: Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration CVE-2026-118266Mediumgithub.com/labstack/echo/v5: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo