Start for Free

Know every threat before it ships

200K+ vulnerabilities, malicious packages, and supply chain threats enriched with Corgea's research.

All npm PyPI Go NuGet crates.io Maven RubyGems

41,934 vulnerabilities

HIGH 8.7
Maven

CVE-2026-28368

Undertow is Vulnerable to HTTP Request/Response Smuggling
HIGH 8.7
Maven

CVE-2026-28367

Undertow is Vulnerable to HTTP Request/Response Smuggling
HIGH 8.7
Maven

CVE-2026-28369

Undertow is Vulnerable to HTTP Request/Response Smuggling
MEDIUM 6.5
Maven

CVE-2026-12993

Apicurio Registry is vulnerable to denial of service through XML entity expansion
HIGH 7.4
Maven

CVE-2026-12992

Apicurio Registry allows upload of WSDL raising HTTP request

HIGH 8.5
Maven

CVE-2026-12975

Apicurio Registry utilities allow SSRF and denial of service through XML parsing
MEDIUM 6.4
Go

CVE-2026-13318

KubeVirt virt-api port-forward handler vulnerable to SSRF via guest-controlled VMI IP address
MEDIUM 4.2
Go

CVE-2026-13218

KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite
LOW 3.8
Go

CVE-2026-13322

KubeVirt downward metrics virtio-serial server vulnerable to unbounded memory consumption
CRITICAL 9.8
npm

CVE-2026-41242

protobufjs has an arbitrary code execution issue
MEDIUM 6.5
Go

CVE-2026-55098

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735
MEDIUM 4.3
npm

CVE-2026-93363

@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter
HIGH 7.3
Maven

CVE-2026-53404

Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability
MEDIUM 6.1
Maven

CVE-2026-50229

Apache Tomcat has a Cross-site Scripting vulnerability
UNKNOWN
npm

CVE-2026-118764

minimatch has potential denial of service via globparts amplification
CRITICAL 9.1
Maven

CVE-2026-55276

Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability
MEDIUM 6.5
Maven

CVE-2026-55955

Apache Tomcat has an Improper Authentication vulnerability
MEDIUM 6.5
Maven

CVE-2026-55956

Apache Tomcat has an Improper Authorization vulnerability
HIGH 7.3
Maven

CVE-2026-55957

Apache Tomcat has a Missing Critical Step in Authentication vulnerability
MEDIUM 6.1
npm

CVE-2026-113787

odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values
HIGH 7.5
Maven

CVE-2026-50750

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have a Denial of Service via Out of Memory vulnerability
HIGH 7.5
Maven

CVE-2026-50734

Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All has a Memory Allocation with Excessive Size Value vulnerability
HIGH 7.5
Maven

CVE-2026-53917

Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker have Memory Allocation with Excessive Size Value vulnerability
HIGH 8.1
Maven

CVE-2026-49877

Apache ActiveMQ Improper Authorization vulnerability
HIGH 7.5
Maven

CVE-2026-49434

Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Improper Input Validation vulnerability
UNKNOWN
PyPI

CVE-2026-114054

CVE-2026-114054
UNKNOWN
PyPI

CVE-2026-114052

CVE-2026-114052
HIGH 7.5
NuGet

CVE-2026-50524

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability
HIGH 7.5
NuGet

CVE-2026-50651

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability
HIGH 7.5
NuGet

CVE-2026-57108

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
HIGH 7.8
NuGet

CVE-2026-50650

Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability
HIGH 8.8
NuGet

CVE-2026-69522

Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
UNKNOWN
Go

CVE-2026-72815

chi Has an IP Spoofing Vulnerability in `middleware.RealIP`
HIGH 7.8
Maven

CVE-2026-40048

Camel-PQC Vulnerable to Deserialization of Untrusted Data
CRITICAL 9.8
npm

CVE-2026-44009

vm2 has Sandbox Breakout Through Null Proto Exception
CRITICAL 9.8
npm

CVE-2026-26332

VM2 Has a Sandbox Escape Issue via SuppressedError
CRITICAL 9.8
npm

CVE-2026-44008

vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
HIGH 7.5
npm

CVE-2026-12151

undici WebSocket client vulnerable to denial of service via fragment count bypass
CRITICAL 9.8
npm

CVE-2026-24118

VM2 Sandbox Breakout Through __lookupGetter__
HIGH 7.5
npm

CVE-2026-45109

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
CRITICAL 9.8
npm

CVE-2026-24781

VM2 Has Sandbox Breakout Through Inspect Function
CRITICAL 9.1
npm

CVE-2026-44007

vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
HIGH 7.5
npm

CVE-2026-49293

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals
HIGH 7.5
Maven

CVE-2026-24734

Apache Tomcat has an Improper Input Validation vulnerability
CRITICAL 9.8
PyPI

CVE-2026-39892

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs
HIGH 7.5
PyPI

CVE-2026-27489

onnx Vulnerable to Path Traversal via Symlink
HIGH 7.5
Maven

CVE-2026-5598

Bouncy Castle Has Covert Timing Channel Vulnerability
HIGH 8.8
Go

CVE-2026-33433

Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField
HIGH 8.1
PyPI

CVE-2026-33236

NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite
HIGH 8.6
PyPI

CVE-2026-0847

NLTK has a Path Traversal issue
HIGH 8.8
PyPI

CVE-2026-24747

PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
MEDIUM 6.5
npm

CVE-2025-13465

Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions
MEDIUM 6.5
npm

CVE-2026-121425

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
MEDIUM 6.5
npm

CVE-2026-121426

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
MEDIUM 6.5
npm

CVE-2026-121424

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
HIGH 7.5
Maven

CVE-2026-42440

Apache OpenNLP AbstractModelReader has an OOM Denial of Service via Unbounded Array Allocation
CRITICAL 9.1
Maven

CVE-2025-55017

Apache IoTDB has a Path Traversal vulnerability
CRITICAL 9.1
Maven

CVE-2025-64152

Apache IoTDB has a Path Traversal vulnerability
HIGH 7.3
Maven

CVE-2026-57915

Apache Kerby has a bypass the Kerberos pre-authentication check
MEDIUM 5.4
Go

CVE-2026-13426

github.com/mattermost/mattermost/server/public vulnerable to path traversal in API route construction

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes