Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-50027Criticalmcp-memory-service: mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Write/DeleteCVE-2026-45045Mediumgithub.com/gofiber/fiber/v3: GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add() in BalancerForwardCVE-2026-44332Mediumgithub.com/gofiber/fiber/v3: GoFiber Vulnerable to Username Enumeration via Timing Oracle in BasicAuth Default AuthorizerCVE-2026-8147Highmlflow: MLflow: trace API endpoints lack proper authorization validatorsGHSA-9C3V-684M-579CMediumopenclaw: OpenClaw MCP SSE redirects could forward Authorization headersCVE-2026-50143High@apify/actors-mcp-server: Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify tokenCVE-2026-50139Mediumgoshs.de/goshs/v2: goshs: Share-link ?token=… redemption races past download limitCVE-2026-53943Criticalghost: Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview headerCVE-2026-50138Highgoshs.de/goshs/v2: goshs: WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flagsGHSA-VH4V-2XQ2-G5CGMediumoras.land/oras-go/v2: ORAS Go forwards registry credentials across registry redirectsCVE-2026-53712Highcom.ongres.scram:scram-client: OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithmsCVE-2026-50163Highoras.land/oras-go/v2: `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolutionCVE-2026-50162Mediumoras.land/oras-go/v2: oras-go has file store write outside workingDir via symlink traversalCVE-2026-49119Highgradio: Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacksCVE-2026-50151Highoras.land/oras-go/v2: oras-go blob upload vulnerable to credential forwarding via unvalidated Location headerCVE-2026-9795Highorg.keycloak:keycloak-services: Keycloak has privilege escalation via improper scope mapping enforcementCVE-2026-48978Loworas.land/oras-go/v2: oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokensCVE-2026-41052Criticalgithub.com/rancher/rancher: Rancher has Privilege Escalation from Project Owner to HostCVE-2026-48824Mediumgithub.com/axllent/mailpit: Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release…CVE-2026-48819Medium@hey-api/openapi-ts: @hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` keyCVE-2026-41053Highgithub.com/rancher/rancher: Rancher has over-inclusive team membership expansion in GitHub App authentication providerCVE-2026-44935Criticalgithub.com/rancher/fleet: Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm DeployerCVE-2026-44936Mediumgithub.com/rancher/fleet: Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yamlCVE-2026-44939Criticalgithub.com/rancher/rancher: Rancher vulnerable to command injection through unsanitized YAML parameterCVE-2026-44937Highgithub.com/rancher/fleet: Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo