Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44938Highgithub.com/rancher/fleet: Fleet has PSS Bypass through addLabelsFromOptions in Fleet AgentGHSA-J6HM-V3X2-QV6JLowland.oras:oras-java-sdk: land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directoryCVE-2026-49998Highgithub.com/centrifugal/centrifugo/v6: Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypassCVE-2026-49997Mediumsurrealdb: SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deletedCVE-2026-63761Mediumsurrealdb: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitationGHSA-C8JX-96C9-8XRPMediumsurrealdb: SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast pathsGHSA-WP87-MGVQ-5J93Mediumsurrealdb: SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorizationCVE-2026-63743Mediumsurrealdb: SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirectGHSA-6WQW-VHFR-9999Mediumsurrealdb: SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptionsGHSA-F82J-V89J-MF86Mediumsurrealdb: SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permissionCVE-2026-63751Mediumsurrealdb: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`CVE-2026-63748Mediumsurrealdb: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messagesGHSA-4M82-P8CX-F94JMediumsurrealdb: SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controlsGHSA-65RJ-R9FH-JP2VMediumsurrealdb: SurrealDB vulnerable to pre-auth memory amplification via unbounded `/sql` WebSocket framesCVE-2026-63758Mediumsurrealdb: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live QueriesGHSA-4V76-CW68-4VC9Mediumsurrealdb: SurrealDB: Crafting malicious LIVE queries writes to the database, resulting in DoS, without permission to the table requiredGHSA-6VG3-HGRW-P5GFMediumsurrealdb: SurrealDB has an Authorization Bypass via Composite Record-id PathsCVE-2026-63746Mediumsurrealdb: SurrealDB: Graph traversal bypasses table SELECT permissionsCVE-2026-63755Mediumsurrealdb: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth levelGHSA-Q8QP-67F9-WR3FMediumsurrealdb: SurrealDB vulnerable to Denial of Service due to nested types annotationsGHSA-WJJJ-24CX-F28GHighsurrealdb: SurrealDB has unauthenticated remote DoS via malformed RPC `use` callCVE-2026-63760Highsurrealdb: SurrealDB has Denial of Service in JSON parser due to nested objectsGHSA-4VGR-H27G-CF9PHighsurrealdb: SurrealDB: HTTP RPC Session Race Condition Allows Privilege EscalationGHSA-5QFP-32CF-69JHHighsurrealdb: SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo