Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-50285Highgithub.com/pomerium/pomerium: Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE CallbackCVE-2026-50276Highdatadog: dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50274Highgithub.com/DataDog/dd-trace-go: dd-trace-go: Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50273HighDatadog.Trace: dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50272Highdd-trace: dd-trace-js: Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50271Highddtrace: dd-trace-py: Improper parsing of W3C baggage headers may lead to DoSCVE-2026-50270Highcom.datadoghq:dd-java-agent: dd-trace-java: Improper parsing of W3C baggage headers may lead to DoSCVE-2026-54497Mediumview_component: ViewComponent: Reused Component Instances Retain Stale Render ContextCVE-2026-54498Highview_component: ViewComponent: around_render HTML-Safety BypassCVE-2026-54495Mediumgithub.com/open-feature/open-feature-operator: open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant…GHSA-R3HX-X5RH-P9VVHighdjango-haystack: django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result DeserializationGHSA-7GCF-G7XR-8HXJMediumserde_with: serde_with: KeyValueMap serialization panics on empty sequence or map entriesCVE-2026-54490Mediumwebsocket-driver: websocket-driver: Resource limit bypass via message compressionCVE-2026-54466Criticalwebsocket-driver: websocket-driver: Message corruption via abuse of protocol length headersCVE-2026-54465Mediumwebsocket-driver: websocket-driver: Memory exhaustion in HTTP header parserCVE-2026-54464Mediumwebsocket-driver: websocket-driver: Resource limit bypass via message compressionCVE-2026-54463Mediumwebsocket-driver: websocket-driver: Memory exhaustion via abuse of protocol length headersCVE-2026-54254Mediumcyberdrop-dl-patched: Pixeldrain API key shared with unverified thirdparty sitesCVE-2026-54457Hightensorzero: TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpointCVE-2026-54452Mediumgithub.com/doyensec/safeurl: safeurl is Missing IPv6 CIDR Ranges in BlocklistCVE-2026-53656Mediumfiftyone: FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server dataGHSA-62GX-5Q78-WRVXHighobsidian-local-rest-api: obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/deleteCVE-2026-54450Lowgithub.com/stacklok/toolhive: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gatewayCVE-2026-62944Highmantisbt/mantisbt: MantisBT: Stored XSS in print_all_bug_page_word.phpCVE-2026-52883Mediummantisbt/mantisbt: MantisBT: Injection of TIME_TRACKING and REMINDER Notes via REST and SOAP APIs

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo