Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-61609Highpterodactyl/panel: Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)CVE-2026-55771Highcom.cedarpolicy:cedar-java: Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilitiesCVE-2026-54545High@wakaru/cli: @wakaru/cli arbitrary file write during bundle unpackCVE-2026-47427Highgithub.com/github/github-mcp-server: GitHub MCP Server has Nil Pointer Dereference DoS in completion/complete HandlerCVE-2026-46428Criticallettre: lettre has TLS hostname verification disabled when using Boring TLS backendCVE-2026-45293Highwp-coding-standards/wpcs: WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilityCVE-2026-43910Highio.appium:java-client: java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutorGHSA-HP74-GM6M-2QM5Mediumgithub.com/pocket-id/pocket-id/backend: Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that…CVE-2026-43983Highgithub.com/pocket-id/pocket-id/backend: Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictionsCVE-2023-37465Mediumorg.xwiki.contrib:discussions-server: org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messagesCVE-2026-66053Mediumthrift: Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilitCVE-2026-41608Highthrift: Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerabilityCVE-2026-43871Highthrift: Apache Thrift Python, Go, PHP and Java bindings have an Infinite LoopCVE-2025-71408Highnltk: NLTK vulnerable to Eval Injection via collocations CLI argumentsCVE-2026-73500Highgo.etcd.io/etcd/v3: etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadlineGHSA-8Q49-2H5H-434XMedium@frontmcp/adapters: FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change pollerCVE-2026-73502Mediumgithub.com/getkin/kin-openapi: kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has…CVE-2026-16796Highbedrock-agentcore: AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()CVE-2026-73499Highgo.etcd.io/etcd/v3: etcd: Watch API authorization bypass via open-ended range requestsCVE-2026-16756Highaws-smithy-http-server: Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris…CVE-2026-73568Highlibp2p: libp2p: yamux connection DoS via oversized data frameCVE-2026-73647Mediumquasar: Quasar: Prototype pollution in the extend() utilityCVE-2026-73505Highgithub.com/jandedobbeleer/oh-my-posh: Oh My Posh: Arbitrary command execution via template injection in the path segmentCVE-2026-73506Mediumgithub.com/jandedobbeleer/oh-my-posh: Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment dataCVE-2026-102695Highorg.omnifaces:omnifaces: OmniFaces: Forged combined-resource IDs and related output/push boundaries

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo