Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-C534-2W9C-X7FMMediumgithub.com/zxh326/kite: Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resourcesCVE-2026-73644Criticalorg.openidentityplatform.opendj:opendj-server-legacy: OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope checkGHSA-68R5-9HPG-7QW9Criticalorg.openidentityplatform.opendj:opendj-dsml-servlet: OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gatewayGHSA-G3HQ-HPHG-8FHHHighpheditor/pheditor: Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization…GHSA-94P4-4CQ8-9G67HighGitPython: GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)CVE-2026-73307Medium@budibase/server: Budibase: SSRF via bare fetch() in uploadUrl during AI table generationCVE-2026-73410High@budibase/server: Budibase: SSRF via DNS rebinding in the REST datasource integrationGHSA-PMPG-2MXQ-6XWRHigh@budibase/server: Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/deleteCVE-2026-73306Medium@budibase/server: Budibase: Account Enumeration via Login Lockout Response DifferentialGHSA-PVCR-8MVP-W8QRHigh@budibase/server: Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)GHSA-2XGG-R2WC-C5R2High@budibase/server: Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database ConnectorGHSA-QW6M-8FW2-2V64High@budibase/server: Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query ExecutionCVE-2026-73308Medium@budibase/server: Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other BuildersCVE-2026-73406High@budibase/server: Budibase: Unauthenticated user information disclosure via public tenant user lookup endpointGHSA-MQHR-6J6H-74P5Critical@budibase/server: Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak CVE-2026-62323Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve WOPI view sessions can write files and WOPI access token secret is ignoredCVE-2026-73302Critical@budibase/server: Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verifiedGHSA-XG5G-26X8-CVF4High@budibase/server: Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query executionGHSA-XCX6-4F2G-HHGXHigh@budibase/server: Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLsCVE-2026-73409High@budibase/server: Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFileCVE-2026-73300Critical@budibase/server: Budibase: SQL Injection via `multipleStatements: true`CVE-2026-73303High@budibase/server: Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)CVE-2026-73304Medium@budibase/server: Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role UsersCVE-2026-73301Medium@budibase/server: Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappingsCVE-2026-73305High@budibase/server: Budibase: Privilege escalation via public role assignment API missing app-level authorization

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo