Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54680Criticalgithub.com/kube-logging/logging-operator: Logging operator has Fluentd configuration injection that allows remote code executionCVE-2026-54693Highgithub.com/zitadel/zitadel: ZITADEL Users Can Self-Verify Email/Phone via APICVE-2026-54727Highproot-distro: proot-distro has a Container Isolation Bypass via Crafted Restore ArchiveCVE-2026-54574Highproot-distro: `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar ArchiveCVE-2026-52838Lowalextselegidis/easyappointments: Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSSCVE-2026-52841Lowalextselegidis/easyappointments: Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google syncCVE-2026-52837Mediumalextselegidis/easyappointments: Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule pageCVE-2026-52839Lowalextselegidis/easyappointments: Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization BypassCVE-2026-52840Lowalextselegidis/easyappointments: Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal networkCVE-2026-55651Highalextselegidis/easyappointments: Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data ExposureGHSA-WCHH-9X6H-7F6PMediummatrix-commander: olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193CVE-2026-11393High@aws/agentcore: AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote EscapingCVE-2026-54735Criticalgithub.com/prebid/prebid-server/v4: prebid-server's request forgery vulnerability allows for possible host environment data extractionCVE-2026-50559Highio.quarkus:quarkus-vertx-http: Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization VulnerabilitiesGHSA-PC2W-4MQ8-32QWLow@dynatrace-oss/dynatrace-mcp-server: @dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gateCVE-2026-50558Mediumpenelope-shell-handler: Penelope unsafe tar extraction allows arbitrary local file write via crafted session archiveCVE-2026-67214Highnanoid: nanoid: non-secure generators can loop indefinitely with negative sizeCVE-2026-67213Highnanoid: nanoid: custom generators can loop indefinitely when size is zeroCVE-2026-54081Mediumorg.verapdf:parser: veraPDF Parser DoS via PostScript Type 1 Font ProgramsCVE-2026-54080Mediumorg.verapdf:parser: veraPDF Parser DoS via PostScript CMap StreamsCVE-2026-54082Mediumorg.verapdf:validation-model: veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFsCVE-2026-54078Highorg.verapdf:validation-model: veraPDF Validation XXE via Rich TextCVE-2026-54079Highorg.verapdf:validation-model: veraPDF Validation XXE via XFA

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo