Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-4318Critical@aws-amplify/codegen-ui-react: AWS Amplify Studio UI Component Properties Has an Input Validation IssueCVE-2026-66066Criticalactivestorage: Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processingCVE-2026-54522Lowmsgpack: MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer DisclosureCVE-2026-54722Highdssrf: dssrf has an SSRF bypass with remove_at_symbol_in_stringCVE-2026-67424Highflyto-core: Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidationCVE-2026-67428Highflyto-core: Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to…CVE-2026-67426Criticalflyto-core: Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltrationCVE-2026-67425Highflyto-core: Flyto2 Core: LLM/API keys leak to an attacker-controlled base_urlCVE-2026-67427Highflyto-core: Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylistedCVE-2026-67429Criticalflyto-core: Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)CVE-2026-67435Mediumlinuxfabrik-lib: linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirectCVE-2026-67431Highmcp: MCP Ruby SDK: Ruby SSE Session PoisoningCVE-2026-67432Highmcp: MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransportCVE-2026-67430Mediummcp: MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize floodCVE-2026-63119Mediummcp: MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)CVE-2026-63118Mediummcp: MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protectionCVE-2026-67438Mediumgithub.com/OliveTin/OliveTin: OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety CheckCVE-2026-67439Mediumgithub.com/OliveTin/OliveTin: OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action OutputCVE-2026-67437Highgithub.com/OliveTin/OliveTin: OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)CVE-2026-13346Mediumpip: pip would incorrectly handle doubly-encoded package URLs from indexesCVE-2026-54705Mediummathlive: mathlive's Lack of Escaping of HTML allows for XSSCVE-2026-54704Mediumio.opentelemetry.javaagent:opentelemetry-javaagent: OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text PasswordsCVE-2026-54712Mediumio.opentelemetry.javaagent:opentelemetry-javaagent: OpenTelemetry Javaagent RMI context propagation allows resource exhaustionGHSA-PMWX-RM49-XV39Lowactiverecord-tenanted: ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversalGHSA-XVG2-CGV6-6H7VHighgithub.com/tinfoil-factory/netfoil: netfoil: Incorrect block responses could lead to localhost traffic

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo