Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-70488Mediumopen-webui: Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanupCVE-2026-70486Highopen-webui: Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-originCVE-2026-70485Highopen-webui: Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLsCVE-2026-70484Mediumopen-webui: Open WebUI: Users denied the image-generation permission can still generate images via chat completionsCVE-2026-70480Mediumopen-webui: Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart renderingCVE-2026-70483Lowopen-webui: Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpointCVE-2026-70482Highopen-webui: Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any clientCVE-2026-70481Mediumopen-webui: Open WebUI: Any member with write access to a standard channel can edit or delete other members' messagesCVE-2026-70479Highopen-webui: Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loaderCVE-2026-70478Criticalflowise: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected serviceCVE-2026-70477Criticalflowise: Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-70476Highflowise: Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationGHSA-8GJ2-2CVC-6XX7Mediumflowise: Flowise: Unauthenticated Credential Abuse via Text-to-Speech Endpoint Allows Unauthorized Use of Private Chatflow TTS CredentialsCVE-2026-70475Highflowise: Flowise: Missing Authorization on Execution Update EndpointCVE-2026-15307HighDjango: Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsingCVE-2026-15830Mediumdjango: Django GeoDjango vulnerable to denial of service through deeply nested geometry collectionsCVE-2026-70474Highflowise: Flowise: Cross-Workspace OAuth2 Credential Metadata LeakGHSA-RWRP-9823-P2XQMediumflowise: Flowise: Incomplete Credential Redaction Exposes Secrets via APICVE-2026-70473Highflowise: Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert historyCVE-2026-70472Highflowise: Flowise: Cross-workspace credential IDOR in openai-assistants-vector-storeCVE-2026-69264Criticalflowise: Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validationGHSA-88PR-878C-24WFHighflowise-components: Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys …CVE-2026-70471Highflowise: Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables DisclosureCVE-2026-70470Criticalflowise: Flowise: Pyodide validator Unicode homoglyph bypass leads to RCECVE-2026-69263Highflowise: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo