Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-69262Highflowise: Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each…CVE-2026-69259Criticalflowise: Flowise RCE via SQLite Record Manager NodeCVE-2026-69258Highflowise: Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction APICVE-2026-69257Highflowise: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 AddressesCVE-2026-69256Criticalflowise-components: Flowise: Remote Code Execution Vulnerability in CSVAgentCVE-2026-69255Criticalflowise: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell VerifiedCVE-2026-69254Criticalflowise: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions OverrideCVE-2026-69253Criticalflowise: Flowise Sandbox Escape to RCECVE-2026-69252Highflowise: Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same…CVE-2026-69251Criticalflowise: Flowise RCE via TypeORM DataSourceCVE-2026-69250Highflowise: Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret ExfiltrationGHSA-2364-JH4Q-M9VMMediumflowise: Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpointCVE-2026-69248Mediumcryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtreesCVE-2026-69249Highcryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-buildingCVE-2026-69247Highcryptography: cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timingCVE-2026-69246Highguzzlehttp/guzzle: Guzzle: Noncanonical host can bypass host-based checksCVE-2026-69245Mediumguzzlehttp/guzzle: Guzzle: Noncanonical cookie domain keeps subdomain scopeCVE-2026-69244Highaiohttp: AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)CVE-2026-69243Mediumaiohttp: AIOHTTP: HTTP request smuggling via WebSocket upgradeCVE-2026-59881Mediumaiohttp: AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateCVE-2026-69240Criticalsequelize: Sequelize: SQL Injection (Oracle DB)CVE-2026-69207Mediumhono: Hono: ReDoS in CORS middleware via Access-Control-Request-HeadersGHSA-P538-C434-8V24MediumGitPython: GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.countGHSA-539M-9XH6-Q6RRMediumGitPython: GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via…GHSA-3F7W-8RR8-F37FHighGitPython: GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo