Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44907Highreact-server-dom-webpack: react-server-dom: Denial of Service in Server FunctionsCVE-2026-62379Criticalorg.openidentityplatform.openam:openam-core: OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackCVE-2026-62280Mediumorg.openidentityplatform.openam:openam-oauth2: OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent pageCVE-2026-62263Criticalorg.openidentityplatform.openam:openam-auth-webauthn: OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassCVE-2026-59221Highopen-webui: open-webui terminal proxy path traversal guard bypass via 9x encoded traversalCVE-2026-59225Mediumopen-webui: Open WebUI: Arena task endpoints can bypass underlying model access controlsCVE-2026-59212Mediumopen-webui: Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/deleteCVE-2026-59224Highopen-webui: Open WebUI: Terminal proxy forwards a spoofable, integrity-unbound user identity to the upstream (X-User-Id header and ws_terminal…CVE-2026-59223Mediumopen-webui: Open WebUI: `WEB_FETCH_FILTER_LIST` host allow/block filter bypassable via URL path and non-label-boundary matchingCVE-2026-57497Mediumgithub.com/quic-go/webtransport-go: webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown CapsulesCVE-2026-55502Highgithub.com/cloudreve/Cloudreve/v4: Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentialsCVE-2026-55499Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and…CVE-2026-55497Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the serverCVE-2026-55496Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned…CVE-2026-55495Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner AccountCVE-2026-55404Highyt-dlp: yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link outputCVE-2026-59222Mediumopen-webui: Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentialsCVE-2026-59215Lowopen-webui: Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id bindingCVE-2026-59213Lowopen-webui: Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse)CVE-2026-59217Mediumopen-webui: Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)CVE-2026-59216Highopen-webui: Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_idCVE-2026-59714Highopen-webui: Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)CVE-2026-59219Highopen-webui: Open WebUI: Realtime endpoints accept Redis-revoked JWTs after signout/backchannel logoutCVE-2026-59715Lowopen-webui: Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)CVE-2026-59227Mediumopen-webui: Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo