Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-55086Mediumep_etherpad-lite: ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite CVE-2026-55087Mediumep_etherpad-lite: ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header CVE-2026-55072Highpimcore/pimcore: Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name CVE-2026-45819Mediumbaseline-browser-mapping: baseline-browser-mapping process termination on invalid input causes denial of service CVE-2026-55074Highansible-jailexec: Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)GHSA-PFVM-W89X-94JWHighSIPSorcery: SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)GHSA-JWJP-4649-V8JPHighSIPSorcery: SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing CVE-2026-55071Highstata-mcp: MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`CVE-2026-54917Highgithub.com/seaweedfs/seaweedfs: SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access CVE-2026-68970Mediumapache-airflow: Apache Airflow Task SDK fails to mask list-shaped JSON Variables CVE-2026-68969Mediumapache-airflow: Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext CVE-2026-68971Mediumapache-airflow: Apache Airflow missing team context permits cross-team Dag actions and XCom reads CVE-2026-67260Highapache-airflow: Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs CVE-2026-59242Mediumapache-airflow: Apache Airflow XCom API permits unsafe deserialization through JSON string literals CVE-2026-67587Highapache-airflow: Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler CVE-2026-54183Mediumapache-airflow: Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables CVE-2026-65017Mediumapache-airflow: Apache Airflow Config API exposes team-scoped sensitive configuration values CVE-2026-68076Mediumapache-airflow: Apache Airflow environment-variable secrets backend permits cross-team credential use CVE-2026-68968Highapache-airflow: Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass CVE-2026-59244Mediumapache-airflow: Apache Airflow exposes dict-valued var.json secrets in Rendered Templates CVE-2026-58076Highapache-airflow: Apache Airflow exception-node deserialization permits arbitrary callable execution CVE-2026-52776Highcompliance-trestle: compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0 CVE-2026-48798HighSSH.NET: SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames CVE-2026-48786Mediumgithub.com/fleetdm/fleet/v4: Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint CVE-2026-47132Mediumthorsten/phpmyfaq: phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo