Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-48815Highsigstore: sigstore's `certificateOIDs` verification constraints are silently dropped and never enforcedCVE-2026-48816Medium@sigstore/verify: sigstore-js has Insufficient Verification of Data AuthenticityCVE-2026-49989Lowio.crate:crate: CrateDB's Blob HTTP handler bypasses authorizationGHSA-M492-GV72-XVXJLowkimai/kimai: Kimai Password Reset Link Remains Valid After Password ChangeCVE-2026-49988Mediumrepomix: repomix: attach_packed_output can bypass file-read secret scanning for supported local filesCVE-2026-49826Lowgithub.com/concourse/concourse: Concourse login flow has an open redirect issueCVE-2026-49987Highrepomix: repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument InjectionGHSA-MJGF-XJ26-9QF9Highpay: pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierCVE-2026-49981Hightwig/twig: Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`GHSA-3CCM-4QQ2-5WRPMediumgithub.com/edgelesssys/contrast: Constrata's coordinator transit engine `ciphertextContainer.UnmarshalJSON` panics on attacker-controlled short ciphertextsGHSA-6C87-G9PW-78FXLowgithub.com/edgelesssys/contrast: Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain…CVE-2026-49986Highneuro-cortex-memory: Cortex has Untrusted Project Bootstrap Code Execution via `CLAUDE_PROJECT_DIR`GHSA-HWMC-R6MF-JH83Lowspatie/schema-org: Schema.org has cross-site scripting (XSS) via script break-out in toScript() outputCVE-2026-54428Highorg.apache.httpcomponents.core5:httpcore5-h2: Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACKCVE-2026-54399Highorg.apache.httpcomponents.core5:httpcore5: Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of serviceCVE-2026-12480Mediumkeras: Keras: HDF5 virtual datasets can disclose local filesCVE-2026-49864Highwetty: wetty vulnerable to DOM XSS via file-download filenameGHSA-2WWR-9X6F-88GPMediumeasycorp/easyadmin-bundle: EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig componentsCVE-2026-49857Highauth-fetch-mcp: auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 LoopbackCVE-2026-49856Medium@jshookmcp/jshook: @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorizationCVE-2026-46487Highorg.geonetwork-opensource:geonetwork: GeoNetwork has ACL bypass on Elasticsearch search when request body omits query fieldCVE-2026-39379Highorg.geonetwork-opensource:geonetwork: GeoNetwork has reflected XSS through client-side template injectionCVE-2022-46295Highopenbabel: Open Babel has out-of-bounds write in MSI translationVectors[]CVE-2022-46294Highopenbabel: Open Babel has out-of-bounds write in MOPAC IN translationVectors[] (Tv atom)CVE-2022-46293Highopenbabel: Open Babel has out-of-bounds write in MOPAC translationVectors[] (FINAL POINT)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo