Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-73649Criticalvelocityjs: Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)CVE-2026-73563Medium@backstage/plugin-auth-backend: @backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypassCVE-2026-62946MediumMagick.NET-Q16-AnyCPU: ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit buildsCVE-2026-62363MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Write in fx operationCVE-2026-62343MediumMagick.NET-Q16-AnyCPU: ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is providedCVE-2026-61632Mediumpymdown-extensions: PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_pathCVE-2026-73428Mediumtrix: Trix: Stored XSS via HTMLParser attribute injection on pasteCVE-2026-73851MediumMicrosoft.OpenApi.Kiota: Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)CVE-2026-59952Mediumvalibot: Valibot: record() issue paths can make flatten() throw for inherited Object property namesCVE-2026-59940Criticalseroval: seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationCVE-2026-59949Mediumat.yawk.lz4:lz4-java: LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array rangesCVE-2026-59866HighMicrosoft.OpenApi.Kiota: Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceNameCVE-2026-59865CriticalMicrosoft.OpenApi.Kiota: Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`CVE-2026-59863HighMicrosoft.OpenApi.Kiota: Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRFCVE-2026-59867HighMicrosoft.OpenApi.Kiota: Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $refCVE-2026-59864CriticalMicrosoft.OpenApi.Kiota: Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensionsGHSA-866W-XMHQ-WJ7XMedium@sveltejs/kit: SvelteKit: Prototype pollution in file input deletion path in remote-function formsGHSA-WQJV-9729-C5Q2Medium@sveltejs/kit: SvelteKit: Big remote form function payloads can cause Node process to crashCVE-2026-13769Mediumawscli: AWS CLI: Overly permissive File PermissionsCVE-2026-63632Lowonnx: ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input ShapeCVE-2026-57516Highray: Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)CVE-2026-59859HighMicrosoft.OpenApi.Kiota: Microsoft Kiota: Code Generation Literal Injection in Kiota PHP GeneratorCVE-2026-59862HighMicrosoft.OpenAPI.Kiota: Microsoft Kiota: Code Generation Literal Injection in Kiota Python GeneratorCVE-2026-59861HighMicrosoft.OpenAPI.Kiota: Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby GeneratorGHSA-QQ9H-G4JM-XGF3Highbetter-auth: Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo