Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-53512Criticalbetter-auth: Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp pluginsGHSA-7856-G3GV-9WQ8Lowgithub.com/tinfoil-factory/netfoil: netfoil: Attacker controlled data written to logsGHSA-3G4Q-2F67-2GVHLowgithub.com/tinfoil-factory/netfoil: netfoil has a resource leak in LRU cacheGHSA-59QP-CFJ3-RP64Mediumgithub.com/tinfoil-factory/netfoil: netfoil has a domain name filter bypass via multiple questionsGHSA-FQF6-GXHH-2XHWHighuucore: uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)CVE-2026-53509Medium@aborruso/ckan-mcp-server: @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)CVE-2026-34225Mediumopen-webui: Open WebUI has Blind Server Side Request Forgery in its Image Edit FunctionalityCVE-2026-26193Highopen-webui: Open WebUI vulnerable to Stored XSS via iFrame embeds in response messagesCVE-2026-26192Highopen-webui: Open WebUI vulnerable to Stored XSS via iFrame in citations modelCVE-2025-46719Highopen-webui: Open WebUI vulnerable to stored XSS via unescaped markdown token in MarkdownTokens.svelte leading to full account takeover and RCE via…CVE-2025-46571Mediumopen-webui: Open WebUI allows limited stored XSS vila uploaded html fileCVE-2026-53877Mediumdjango: Django: GDALRaster may over-read heap memory when constructed from bytesCVE-2026-53878Mediumdjango: Django: DomainNameValidator permits newline characters that may enable HTTP header injectionCVE-2026-48588Lowdjango: Django: cache middleware may expose private responses when unrelated request cookies are presentCVE-2026-45016Mediumegroupware/egroupware: EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail ComposeCVE-2026-44512Mediumonnx: ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)CVE-2026-44342Mediumgithub.com/QuantumNous/new-api: New API is vulnerable to CSRF through user email bindingCVE-2026-40187Highegroupware/egroupware: EGroupware has Authenticated RCE via Malicious eTemplate UploadCVE-2026-34151Highorg.xwiki.platform:xwiki-platform-oldcore: XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+CVE-2026-33655Highgithub.com/QuantumNous/new-api: New API: SSRF Protection Bypass via Unresolved Hostname in Notification URLsCVE-2026-27823Criticalegroupware/egroupware: EGroupware has a Remote Code Execution VulnerabilityCVE-2026-49296Mediumapache-airflow: apache-airflow DAG source authorization bypass exposes co-located DAG sourceCVE-2026-49487Mediumapache-airflow: Apache Airflow exposes deferred trigger kwargs in task-instance API responsesCVE-2026-33264Criticalapache-airflow: Apache Airflow allows code execution through unsafe serialized DAG deserializationCVE-2026-48892Mediumapache-airflow: Apache Airflow exposes secrets backend credentials through the Config API

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo