Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-73413Highshescape: Shescape: Quadratic-time denial of service in the flag-protectionCVE-2026-73411Mediumshescape: Shescape: Home-directory disclosure in assignment context on Unix with DashCVE-2026-73414Criticalshescape: Shescape: Shell injection via unescaped parentheses on Windows with CMDCVE-2026-73412Mediumshescape: Shescape: Path disclosure on Unix with ZshCVE-2026-16584Highawslabs.aws-api-mcp-server: AWS API MCP Server Security Policy Bypass via Startup Initialization FailureCVE-2026-69160Mediumgithub.com/OpenListTeam/OpenList/v4: OpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation APIGHSA-P6PH-3JX2-3337Mediumgithub.com/OpenListTeam/OpenList/v4: OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchCVE-2026-73509Highgithub.com/OpenListTeam/OpenList/v4: OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversalCVE-2026-73493Highorg.http4s:http4s-blaze-server_2.13: blaze: Unbounded WebSocket message aggregation in http4s-blaze-serverCVE-2026-73495Highorg.http4s:blaze-http_2.13: blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)CVE-2026-73494Highorg.http4s:http4s-blaze-server_2.13: blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parserGHSA-CMWH-G2H8-C222Highpoweradmin/poweradmin: Poweradmin: OIDC `sub` collation bypass in Poweradmin leading to account takeoverGHSA-RM67-G9CH-VXFFHighpoweradmin/poweradmin: Poweradmin: Broken access control (IDOR): any zone owner can modify DNS records in zones they do not ownGHSA-H4HF-V6W5-897XHighpoweradmin/poweradmin: Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser accountGHSA-F25V-X6VR-962GCriticalpheditor/pheditor: Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current PasswordCVE-2026-14257Highbrace-expansion: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashCVE-2026-64785Mediumswift-nio-http2: swift-nio-http2: Missing CR/LF/NUL validation in header valuesCVE-2026-73567Criticalsm-crypto: sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clockGHSA-V6W6-358X-2433Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve Admin.Read OAuth tokens can trigger server-side node test requestsCVE-2026-73652Highvantage6: vantage6: Algorithm developer can edit another developer's algorithm that is pending / under reviewGHSA-2625-RW7M-5Q5XLowhubuum_client: Hubuum client library (Rust): Sensitive data may be exposed through default diagnosticsGHSA-QQC3-94QV-7FW3Mediumhubuum_client: Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network trafficGHSA-F45Q-W629-WR25Mediumhubuum_client: Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirectsCVE-2026-73564Highgithub.com/fatedier/frp: frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer OverflowCVE-2026-73561High@anephenix/hub: @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo