Know every threat before it ships
200K+ vulnerabilities, malicious packages, and supply chain threats enriched with Corgea's research.
UNKNOWN
CVE-2026-111497
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package
LOW 3.7
CVE-2026-105800
i18next-http-backend incomplete URL validation permits SSRF
MEDIUM 6.8
CVE-2026-82866
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled
UNKNOWN
CVE-2020-37286
Vyper: Memory corruption using function calls within tuples / nested calls
UNKNOWN
CVE-2020-37287
Vyper: Call stack corruption when passing complex type containing non-base type members as argument
UNKNOWN
CVE-2021-48020
VVE-2021-0001: Memory corruption using function calls within arrays
UNKNOWN
CVE-2021-48018
Storage corruption due to variables overwritten by re-entrancy locks
UNKNOWN
CVE-2020-37289
Vyper interfaces returning integer types less than 256 bits can be manipulated if uint256 is used
UNKNOWN
CVE-2020-37288
Vyper: Return inside for loop more than 1 level deep
UNKNOWN
CVE-2021-48019
VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption
UNKNOWN
CVE-2026-58497
Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests
UNKNOWN
CVE-2026-115754
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
UNKNOWN
CVE-2026-57208
Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind in github.com/entireio/cli
HIGH 7.5
CVE-2026-115728
@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing
LOW 2.5
CVE-2026-112907
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
UNKNOWN
CVE-2026-113713
virtualenv: Temporary app-data can leave dangling seed package links
MEDIUM 6.1
CVE-2026-112937
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
LOW 3.3
CVE-2026-112913
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
HIGH 7.5
CVE-2026-109461
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
HIGH 7.5
CVE-2026-109869
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
UNKNOWN
CVE-2026-113714
virtualenv: Downloaded wheel selection and caching precede verification
UNKNOWN
CVE-2026-113720
virtualenv: Seeded files retain permissions from an older cache
UNKNOWN
CVE-2026-113723
virtualenv: Bash prompt values can change meaning under older compatibility modes
MEDIUM 4.5
CVE-2026-113719
virtualenv: Seed replacement does not contain metadata deletion paths
UNKNOWN
CVE-2026-113718
virtualenv: Xonsh activation literals depend on the script decoding codec
UNKNOWN
CVE-2026-113717
virtualenv: Pip seeding with download omits wheel digest verification
UNKNOWN
CVE-2026-113715
virtualenv: Venv configuration readback can reinterpret path boundaries
MEDIUM 5.9
CVE-2026-109924
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
MEDIUM 5.9
CVE-2026-109841
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
MEDIUM 5.3
CVE-2026-112914
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
LOW 3.3
GHSA-h4fr-cmh5-qr62
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
LOW 3.3
CVE-2026-115569
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
HIGH 7.1
CVE-2026-112940
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
HIGH 7.5
CVE-2026-113872
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
UNKNOWN
CVE-2026-115883
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
MEDIUM 6.5
CVE-2026-115886
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
MEDIUM 4.7
CVE-2026-112906
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
HIGH 8.8
CVE-2026-115895
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
CRITICAL 9.1
CVE-2026-53434
Apache Tomcat util accepted misconfigured CRLs
UNKNOWN
CVE-2026-112398
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
UNKNOWN
CVE-2026-114501
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
UNKNOWN
GHSA-xmj3-9gf7-h52w
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
HIGH 7.0
GHSA-9xx9-hw38-h2w9
Duplicate Advisory: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
HIGH 7.5
GHSA-f2hq-32vh-53cc
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
MEDIUM 6.5
GHSA-85x2-q946-cp5h
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
MEDIUM 6.5
GHSA-8c8m-p3m8-cjg8
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
MEDIUM 6.5
GHSA-m943-m63m-w62w
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
HIGH 7.0
CVE-2026-69097
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
MEDIUM 6.8
GHSA-7xgj-8392-5q4r
FastMCP: Post-transform component authorization is skipped on direct calls
MEDIUM 5.9
GHSA-vqqp-x5qm-5qp4
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
HIGH 8.2
CVE-2026-53995
MLflow FileStore trace IDs allow path traversal and arbitrary file writes
LOW 3.7
CVE-2026-110095
fast-uri vulnerable to improper path equivalence in relative reference normalization
LOW 3.7
CVE-2026-110725
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
MEDIUM 6.1
CVE-2026-110306
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
MEDIUM 4.8
CVE-2026-110180
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
MEDIUM 4.8
CVE-2026-114437
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
UNKNOWN
CVE-2026-114110
uv vulnerable to arbitrary file deletion through RECORD entries
Ready to move
Start Securing
Free, no credit card | First findings in minutes