Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-48805Lowtwig/twig: Twig: Sandbox state regression in deprecated internal wrappers in `src/Resources/core.php`CVE-2026-49835Mediumgithub.com/sigstore/timestamp-authority/v2: Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality CVE-2026-49478Highgithub.com/sigstore/fulcio: Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token…CVE-2026-48796MediumCefSharp.Common: CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder CVE-2026-48795High@adonisjs/bodyparser: @adonisjs/bodyparser has an incomplete fix for CVE-2026-25754 CVE-2026-49820Mediumgo.probo.inc/probo: Probo has an open redirect bypass via path normalization CVE-2026-58168Highdeeptutor: DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools CVE-2026-58167Highgithub.com/ccfos/nightingale/v6: Nightingale exposes datasource credentials to low-privilege users CVE-2026-50566Criticalgithub.com/fission/fission: Fission: Environment Runtime.Container and Builder.Container SecurityContext bypass allows privileged pod creation CVE-2026-50565Mediumgithub.com/fission/fission: Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container CVE-2026-50564Criticalgithub.com/fission/fission: Fission Environment CRD podspec passthrough enables hostPID/hostNetwork/privileged pods, node escape CVE-2026-50563Criticalgithub.com/fission/fission: Fission Container Executor Function PodSpec Injection Leading to Node Escape CVE-2026-50545Criticalgithub.com/fission/fission: Fission Environment CRD PodSpec Injection Leading to Node Escape and Cluster Takeover CVE-2026-49824Highgithub.com/fission/fission: Fission: Cross-namespace Environment reference via unvalidated EnvironmentRef in Function admission webhook CVE-2026-49823Highgithub.com/fission/fission: Fission: Cross-namespace Package read via unvalidated PackageRef in Function admission webhook CVE-2026-49822Highgithub.com/fission/fission: Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance CVE-2026-49821Highgithub.com/fission/fission: Fission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration GHSA-7M8X-QG2J-4M3VHighgithub.com/fission/fission: Fission: MessageQueueTrigger scaler manager materializes Secret values into Deployment envvars and accepts arbitrary user PodSpec CVE-2026-48791Lowdev.sigstore:sigstore-java: Sigstore Java has a vulnerability with bundle verification of integratedTime CVE-2026-49473High@cedar-policy/authorization-for-expressjs: @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation GHSA-55F6-4PR5-C7M5Highgithub.com/kahiteam/kahi: Kahi has privilege-drop and socket/log permission issues CVE-2026-47198Highpaymenter/paymenter: Paymenter has URL parameter injection that bypasses paid plan limits at checkout

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo