Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54655Highdatamodel-code-generator: `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generatorCVE-2026-55403Lowdatamodel-code-generator: datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemasCVE-2026-54691Highdatamodel-code-generator: datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirectsCVE-2026-55390Highdatamodel-code-generator: datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with…CVE-2026-32203HighSystem.Security.Cryptography.Xml: Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service VulnerabilityCVE-2026-52888Medium@nocobase/plugin-collection-sql: NocoBase: Sensitive Data Exposure via SQL Blacklist BypassCVE-2026-49446Mediumgithub.com/azukaar/cosmos-server: Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnelCVE-2026-49447Mediumgithub.com/azukaar/cosmos-server: Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokensCVE-2026-50568Lowgithub.com/fission/fission: Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escapeCVE-2026-50567Highgithub.com/fission/fission: Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directoryCVE-2026-50569Mediumgithub.com/fission/fission: Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checksCVE-2026-50570Highgithub.com/fission/fission: Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node…CVE-2026-54635Highpytonapi: pytonapi has a Webhook Custom Path Authentication BypassCVE-2026-54632HighSIPSorcery: SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)CVE-2026-54588Criticalpoweradmin/poweradmin: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.CVE-2026-54609Highcom.quietterminal:qti-neon: QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwardingCVE-2026-54603Highoauth2: OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker hostCVE-2026-54605Highoauth: OAuth: Cross-origin token-request redirects can expose signed request metadataCVE-2026-54620Lowsqlite3-ruby: sqlite3-ruby has Use-After-Free in SQLite Aggregate Function CallbacksCVE-2026-54619Lowsqlite3-ruby: sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different ArityCVE-2026-54332Mediumgithub.com/gopacket/gopacket: GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) ->…CVE-2026-54345Mediumgithub.com/gopacket/gopacket: GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)GHSA-HC4M-Q9JH-XW4JMediumnono-cli: nono-cli'scregistry pack verification can fail open when provenance metadata is absentCVE-2026-54593Highpterodactyl/panel: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsGHSA-VG6V-J97M-H5XQMedium@novu/application-generic: @novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo