Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-61667CriticalDIRAC: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + evalCVE-2026-59955Highcom.ctrip.framework.apollo:apollo: Apollo ConfigService access key authentication bypass via raw config file appId parsingCVE-2026-59954Highcom.ctrip.framework.apollo:apollo: Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matchingCVE-2026-55372Highnukeviet/nukeviet: NukeViet: Pre-authentication SSRF via X-Forwarded-HostCVE-2026-54065Highnukeviet/nukeviet: NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment FunctionCVE-2026-54064Highnukeviet/nukeviet: NukeViet: Multiple Anti-XSS Filter Bypasses Leading to Stored XSS in News ModuleCVE-2026-49259Highnukeviet/nukeviet: NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48118Highnukeviet/nukeviet: NukeViet: Unauthenticated Reflected XSS in Comment ModuleCVE-2026-45579CriticalDIRAC: DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted inputCVE-2026-45573Mediumdecidim-core: Decidim: Push subscriptions can be abused for server-side requestsCVE-2026-45572Mediumdecidim-core: Decidim: HTML content blocks allow stored script executionCVE-2026-45415Mediumdecidim-verifications: Decidim: CSV census record endpoints improper authorizationCVE-2026-45414Highdecidim: Decidim: JWT-backed authentication can be replayed across organizationsCVE-2026-45378Highdecidim-verifications: Decidim: Verification documents can be downloaded through reusable linksCVE-2026-45377Mediumdecidim-core: Decidim: Private exports can be downloaded through reusable linksCVE-2026-45376Mediumdecidim-admin: Decidim: Admin user search allows SQL injection through similarity-based sortingCVE-2026-45330Mediumdecidim-verifications: Decidim: Verification admins can access supplied IDs from other organizationsCVE-2026-45086Mediumdecidim-demographics: Decidim: Forms admin question editor lacks authorizationCVE-2025-32781Mediumcom.ctrip.framework.apollo:apollo: Apollo Portal: There is a risk of unauthorized access to the Apollo configuration centerCVE-2024-27091Mediumgeonode: GeoNode: Stored XSS to full account takeoverCVE-2026-15529Mediumpyod: PyOD persistence.load deserializes untrusted artifacts before validationCVE-2026-49844Mediumorg.apache.logging.log4j:log4j-api: Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serializationGHSA-G936-7JQJ-MWV8Criticalgithub.com/almeidapaulopt/tsdproxy: TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalationCVE-2026-54174Highchainguard.dev/apko: melange: Incomplete package integrity verification allows data section substitutionCVE-2026-61459Criticalmcp-server-kubernetes: mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo