Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-50554Mediumgithub.com/enchant97/note-mark/backend: Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public booksCVE-2026-49477Highsoupsieve: Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector ParserCVE-2026-49476Highsoupsieve: Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector ListsGHSA-52VM-MXX8-F227Highphantom-audio: Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool pathsGHSA-Q6GH-6V2R-HJV3Mediumio.micronaut:micronaut-http-client: Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headersGHSA-387M-935M-C4VWHighio.micronaut:micronaut-http-client: Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoSCVE-2026-48987Mediumpyload-ng: pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManagerCVE-2026-48737Mediumpyload-ng: pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPsCVE-2026-49471Highserena-agent: Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCECVE-2026-49464Highnl.nl-portal:taak: NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taakCVE-2026-49463Mediumnl.nl-portal:documenten-api: NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-librariesCVE-2026-49456Lowwaku: Waku has an Open Redirect via `unstable_redirect` HelperCVE-2026-49455Mediumwaku: Waku: Cross-Origin CSRF on RSC Server Action DispatchCVE-2026-53649Criticalgithub.com/BishopFox/joro: Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCEGHSA-Q95X-7G78-RCCVMediumoneringbuf: OneRingBuf has a Use After Free VulnerabilityCVE-2026-49833Mediumorg.dspace:dspace-api: DSpace: Path Traversal is possible through LDN message generationCVE-2026-49830Mediumorg.dspace:dspace-api: DSpace: ORE resource URI does not validate scheme for non-web resourcesCVE-2026-49831Mediumorg.dspace:dspace-api: DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output pathCVE-2026-49832Highorg.dspace:dspace-api: DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDNGHSA-MXWC-WH95-PW4GMediumtrapster: Trapster Community: Unauthenticated malformed DNS compression pointers crash per-packet honeypot handlerCVE-2026-53634Mediumcode16/sharp: Sharp Missing Authorization Check in Quick Creation Command EndpointsCVE-2026-52831Criticalgithub.com/nuclio/nuclio: Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCECVE-2026-53600Mediumasync-tar: async-tar PAX extension-header desync enables tar entry/content smugglingCVE-2026-50197Highgithub.com/zalando/skipper: Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requestsCVE-2026-49825Highlxml_html_clean: `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo