Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-HRXH-6V49-42GFHighgoogle.golang.org/grpc: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities GHSA-5QHF-9PHG-95M2Lowloofah: Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons CVE-2026-73490Mediumloofah: Loofah: SVG `href` attribute bypasses local-reference restriction CVE-2026-59889Mediumtools.jackson.core:jackson-databind: jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization CVE-2026-73651Mediumtypeorm: TypeORM: migration:generate template-literal code injection CVE-2026-68494Highcom.fasterxml.jackson.core:jackson-core: jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-20779Highcode.gitea.io/gitea: Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface CVE-2026-58429Mediumcode.gitea.io/gitea: Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints CVE-2026-59765Mediumcode.gitea.io/gitea: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata CVE-2026-58511Lowcode.gitea.io/gitea: Gitea: Webhook Authorization Header Returned in Plaintext via API CVE-2026-57897Mediumcode.gitea.io/gitea: Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs CVE-2026-58510Mediumcode.gitea.io/gitea: Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private CVE-2026-58431Mediumgitea.dev: Gitea: Public-only API token restriction is not enforced on team API routes CVE-2026-58427Mediumgitea.dev: Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 CVE-2026-58422Highcode.gitea.io/gitea: Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts CVE-2026-58419Highcode.gitea.io/gitea: Gitea: Notification API leaks private issue metadata after access revocation CVE-2026-25038Highcode.gitea.io/gitea: Gitea: Unauthorized Access to Labels of Private Organizations CVE-2026-27775Highcode.gitea.io/gitea: Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write CVE-2026-24451Highcode.gitea.io/gitea: Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private CVE-2026-58314Highcode.gitea.io/gitea: Gitea: Two SSRF findings CVE-2026-58436Highcode.gitea.io/gitea: Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests CVE-2026-56657Mediumcode.gitea.io/gitea: Gitea SSH Key Parser Denial of Service CVE-2026-58437Highcode.gitea.io/gitea: Gitea: Repository Visibility Manipulation via Git Push Options CVE-2026-55987Highcode.gitea.io/gitea: Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)CVE-2026-58435Mediumcode.gitea.io/gitea: Gitea LFS Deploy-Key Privilege Escalation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo