Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-72R4-9C5J-MJ57Highpnpm: pnpm: `patch-remove` could delete project-selected files outside the patches directoryGHSA-FR4H-3CPH-29XVHighpnpm: pnpm: Hoisted install imports lockfile alias outside node_modulesGHSA-WW5P-J6CJ-6MQQMediumgithub.com/nezhahq/nezha: Nezha Dashboard: DDNS and Notification credential exposure via unredacted list APICVE-2026-55700Highpnpm: pnpm: `stage download` writes outside its destination directory via manifest name/version traversalCVE-2026-55699Mediumpnpm: pnpm: Reserved bin name deletes PNPM_HOME during global removeCVE-2026-55698Highpnpm: pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytesCVE-2026-49338Highgo.senan.xyz/gonic: Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)CVE-2026-49339Highgo.senan.xyz/gonic: gonic: Path Traversal in playlist `id` bypasses ownership check, enabling any user to read/delete other users' playlistsCVE-2026-49340Highgo.senan.xyz/gonic: gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the…CVE-2026-55697Highpnpm: pnpm: Repository-controlled configDependencies can select a pacquet native install engineCVE-2026-55487Highpnpm: pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycleCVE-2026-55180Mediumpnpm: pnpm: Repository config can expand victim environment secrets into registry requests before scripts runCVE-2026-53465MediumMagick.NET-Q16-AnyCPU: ImageMagick has a Heap Buffer Over-Write in SF3 encoder when writing multi-frame imageCVE-2026-53464MediumMagick.NET-Q16-AnyCPU: ImageMagick: Memory Leak in wand option parser when providing invalid argumentsCVE-2026-54244Lowstatamic/cms: Statamic CMS's incorrect authorization lets view-only users submit Live Preview content reserved for editorsCVE-2026-53523Mediumgithub.com/nezhahq/nezha: Nezha Monitoring: OAuth2 Redirect URL — Host Header InjectionCVE-2026-53522Mediumgithub.com/nezhahq/nezha: Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoSCVE-2026-54243Mediumstatamic/cms: Statamic Vulnerable to CSV formula injection in form submission exportsCVE-2026-54242Mediumstatamic/cms: Statamic Vulnerable to Server-Side Request Forgery via Glide (DNS rebinding)CVE-2026-53519Criticalgithub.com/nezhahq/nezha: Nezha Monitoring: Pre-auth path traversal via /dashboard.. prefix confusion leaks jwt_secret_keyCVE-2026-53521Mediumgithub.com/nezhahq/nezha: Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile contextCVE-2026-53520Mediumgithub.com/nezhahq/nezha: Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routingCVE-2026-50015Highpnpm: pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)CVE-2026-50017Mediumpnpm: pnpm binds unscoped user-level npm auth credentials to a repository-selected registryCVE-2026-50016Highpnpm: pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo