Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54725Criticalgithub.com/bank-vaults/vault-secrets-webhook: vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide…CVE-2026-55100Highhashi-vault-js: hashi-vault-js has a path traversal and query parameter injectionCVE-2026-54729Highdssrf: dssrf: any users using 1.1.1.1 DNS is impacted by SSRFCVE-2026-65835Mediumgithub.com/projectcapsule/capsule: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation…CVE-2026-65834Mediumgithub.com/projectcapsule/capsule: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requestsCVE-2026-67550Mediumre2: re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process…CVE-2026-68499Mediumre2: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth…CVE-2026-68501Mediumsylius/mollie-plugin: Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PIICVE-2026-68500Highsylius/mollie-plugin: Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhookCVE-2026-56819Highio.netty:netty-codec-http2: Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)CVE-2026-12075Highnltk: Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE…CVE-2026-12061Highnltk: Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regexCVE-2026-12072Highnltk: Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox…CVE-2026-12074Highnltk: Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the…CVE-2026-54753Mediumnx: `nx graph` dev server permissive CORS policyCVE-2026-41695Highorg.springframework.data:spring-data-commons: Spring Data: Unbounded property-path cache keyed by externally-supplied path stringCVE-2026-54706Mediumonionshare-cli: OnionShare follows symlinks in shared directories, allowing unintended disclosure of local filesCVE-2026-54707Mediumonionshare-cli: OnionShare Receive mode writes uploaded files even when file uploads are disabledCVE-2026-52856Highgithub.com/pterodactyl/wings: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceCVE-2026-52855Criticalgithub.com/pterodactyl/wings: Wings exposes node configuration secrets through egg configuration-file templatingCVE-2026-52857Mediumgithub.com/pterodactyl/wings: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOMGHSA-P7W7-4929-VPJ5High@dynatrace-oss/dynatrace-mcp-server: `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool InvocationGHSA-XRMJ-5G4G-8987Medium@dynatrace-oss/dynatrace-mcp-server: @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notificationGHSA-PQH8-P93P-2RX7Medium@dynatrace-oss/dynatrace-mcp-server: @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQLCVE-2026-64607Mediumorg.apache.httpcomponents.client5:httpclient5: Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo