Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-46584Loworg.apache.camel:camel-mail: Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session propertiesCVE-2026-46453Mediumorg.apache.camel:camel-elasticsearch-rest-client: Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing…CVE-2026-43866Highorg.apache.camel:camel-jms: Apache Camel JMS deserialization filter bypassCVE-2026-43867Criticalorg.apache.camel:camel-pqc: Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no…CVE-2026-46454Criticalorg.apache.camel:camel-cometd: Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated…CVE-2026-46457Highorg.apache.camel:camel-nats: Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client…CVE-2026-40047Criticalorg.apache.camel:camel-docling: Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducerCVE-2026-40859Highorg.apache.camel:camel-vertx-http: Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when…CVE-2026-43865Highorg.apache.camel:camel-hazelcast: Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code executionCVE-2026-46455Criticalorg.apache.camel:camel-keycloak: Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier,…CVE-2026-42527Highorg.apache.camel:camel-jms: Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosureCVE-2026-14802Mediumreact-dev-utils: react-dev-utils openBrowser permits command injection on macOSCVE-2026-12252Highnltk: NLTK Stanford wrapper classes execute untrusted JAR files without verificationCVE-2026-27779Highcode.gitea.io/gitea: Gitea forwarded-proto validation allows canonical URL spoofingCVE-2026-27780Criticalcode.gitea.io/gitea: Gitea pre-receive hook scanner errors allow branch-protection bypassCVE-2026-28705Mediumcode.gitea.io/gitea: Gitea release asset dumps permit path traversal through crafted namesCVE-2026-27660Highcode.gitea.io/gitea: Gitea draft releases and attachments are exposed without write permissionCVE-2026-26307Highcode.gitea.io/gitea: Gitea git grep searches allow server resource exhaustionCVE-2026-25782Mediumcode.gitea.io/gitea: Gitea tracked-time deletion is not scoped to the requested issueCVE-2026-25718Criticalcode.gitea.io/gitea: Gitea template repository generation follows unsafe filesystem pathsCVE-2026-25712Highcode.gitea.io/gitea: Gitea organization permission APIs expose hidden membership and private organization dataCVE-2026-24690Highcode.gitea.io/gitea: Gitea pull request branch permission checks allow unauthorized updates and rebasesCVE-2026-26232Criticalcode.gitea.io/gitea: Gitea OAuth2 authorization codes can be reused after expiryCVE-2026-20909Mediumcode.gitea.io/gitea: Gitea exposes tracked time entries without repository authorizationCVE-2026-27657Highcode.gitea.io/gitea: Gitea primary email ownership bypass allows cross-user email changes

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo