Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54908Mediumgithub.com/pion/dtls/v3: Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageCVE-2026-54909Mediumgithub.com/pion/stun/v3: Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attributeCVE-2026-54787Lowgithub.com/sigstore/sigstore-go: sigstore-go fails to check signature timestamps against a signing key's validity periodCVE-2026-53608High@apostrophecms/seo: @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script TagCVE-2026-53607Lowapostrophe: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host headerCVE-2026-53609Criticalapostrophe: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassCVE-2026-53606Mediumsanitize-html: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background…CVE-2026-68770Criticalsentence-transformers: sentence-transformers local model loading bypasses trust_remote_code and executes custom PythonCVE-2026-53551Mediumgithub.com/free5gc/free5gc: free5GC AUSF: null byte injection in supiOrSuci causes HTTP 500 internal service failureGHSA-3WHF-VGF2-9W6GMediumzaino-state: zaino-state has a Non-Finalized State Reorg — No Cycle Detection or Depth LimitCVE-2026-52887Critical@nocobase/plugin-notification-in-app-message: NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCECVE-2026-53599Highredaxo/source: Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php…CVE-2026-53466MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Read in XCF decoder due to integer conversion overflowCVE-2026-53510Highsavon: Savon::Model evaluates WSDL operation names as Ruby sourceCVE-2026-65841Mediumjodit: Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationCVE-2026-58263Highjodit: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierCVE-2026-54756Mediumjodit: Jodit has prototype pollution via Jodit.configure() / ConfigMergeCVE-2026-62324Mediumjodit: Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSCVE-2026-53502Highthumbor: Thumbor has path traversal via post-validation URL decoding bypass in file_loaderCVE-2026-53505Highthumbor: Thumbor proportion filter allows unbounded post-transform resize leading to remote DoSCVE-2026-53504Highthumbor: Thumbor has Regex Denial of Service (ReDoS) in `convolution` filterCVE-2026-53503Highthumbor: Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoSCVE-2026-53501Highthumbor: Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signatureCVE-2026-53500Highthumbor: Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dotCVE-2026-54737High@phun-ky/defaults-deep: @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo