Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-63642Mediummagicmirror: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgeryCVE-2026-63641Lowmagicmirror: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actionsCVE-2026-61634Lowcom.rabbitmq:amqp-client: RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_maxCVE-2026-63336Mediumcom.rabbitmq:amqp-client: RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITMCVE-2026-63335Mediumcom.rabbitmq:amqp-client: RabbitMQ Java client malformed body frame triggers raw command assembler exceptionCVE-2026-63337Highcom.rabbitmq:amqp-client: RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingCVE-2026-69219Highcom.rabbitmq:amqp-client: RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationCVE-2026-69220Highcom.rabbitmq:amqp-client: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSCVE-2026-63328Mediumgithub.com/aquasecurity/trivy: Trivy Plugin Manager has Path Traversal that Allows Arbitrary File WriteCVE-2026-55839Highio.kestra:kestra: Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injectionGHSA-2MF3-MR2R-R4VFHigh@rhinostone/swig: @rhinostone/swig: arbitrary local file read via include/extends path traversalCVE-2026-70657Mediumcopyparty: Copyparty vulnerable to file/dirkey confusionCVE-2026-69148Highmlflow: MLflow: CreateModelVersion source validation does not check READ permission on referenced run_idCVE-2026-69146Mediummlflow: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-authCVE-2026-64849Criticalmlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS…CVE-2026-56677High9router: 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test EndpointCVE-2026-54148Highorg.http4k:http4k-security-digest: http4k: `DigestAuthProvider.verify` did not bind to request URICVE-2026-54147Mediumorg.http4k:http4k-security-digest: http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URICVE-2026-53766Mediumchrome-devtools-mcp: chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing rootsGHSA-MPWR-8VM7-H73FMediumsoftware.sslmate.com/src/go-pkcs12: package pkcs12: Authentication bypass in Decode functionsCVE-2026-53752Highorg.docx4j:docx4j-core: docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of ServiceCVE-2026-53659Highorg.http4k:http4k-core: http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoSGHSA-J659-8XH6-5PQ5Highatomic-agents-stack: atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out…GHSA-XHCR-CQFR-M3HVHighatomic-agents-stack: atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)CVE-2026-59903Mediumio.netty:netty-codec-http: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo