Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-56654Highcode.gitea.io/gitea: Gitea: Privilege Escalation via Access Token Scope Escalation in APICVE-2026-56755Highcode.gitea.io/gitea: Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package UploadCVE-2026-58507Mediumcode.gitea.io/gitea: Gitea: Private Repository Existence Disclosure via go-get Meta EndpointCVE-2026-57886Mediumcode.gitea.io/gitea: Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment contentCVE-2026-23603Lowcode.gitea.io/gitea: Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claimCVE-2026-58425Mediumcode.gitea.io/gitea: Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)CVE-2026-59763Mediumcode.gitea.io/gitea: Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploadsCVE-2026-56750Criticalcode.gitea.io/gitea: Gitea Remember-Me Token Theft Not Invalidating Attacker SessionCVE-2026-58432Mediumcode.gitea.io/gitea: Gitea: draft release attachment disclosure via missing web authorizationCVE-2026-58428Mediumcode.gitea.io/gitea: Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)CVE-2026-56443Mediumcode.gitea.io/gitea: Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR…CVE-2026-58439Highcode.gitea.io/gitea: Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagCVE-2026-59766Mediumcode.gitea.io/gitea: Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private…CVE-2026-58440Mediumgitea.dev: Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo…CVE-2026-67323HighGitPython: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via…CVE-2026-67325HighGitPython: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklistGHSA-V396-V7Q4-X2QJHighGitPython: GitPython unsafe clone option gate bypass through joined short optionsCVE-2026-73650Highsvgo: SVGO removeScripts plugin leaves some executable scripts intactCVE-2026-66010Lowdompurify: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.GHSA-MHM7-754M-9P8WMediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`CVE-2026-73653Critical@vitest/browser: @vitest/browser: Browser Mode provider commands bypass the file-access permission gateCVE-2026-59891Critical@sigstore/oci: Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registryCVE-2026-59888Mediumcom.fasterxml.jackson.core:jackson-databind: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-57894Highcode.gitea.io/gitea: Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationCVE-2026-59886Highpyasn1: pyasn1: Uncontrolled resource consumption when converting decoded REAL values

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo