Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-50014Mediumpnpm: pnpm: Git Fetch Argument Injection via Lockfile resolution.commitCVE-2026-50021Mediumpnpm: pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity FieldCVE-2026-50573Mediumpnpm: pnpm: Unsafe default behavior breaks integrity checkCVE-2026-50029Mediumjs-toml: js-toml has silent type confusion via falsy-primitive duplicate-key bypassCVE-2026-49349Mediumgithub.com/regclient/regclient: regclient may leak authentication credentials to external blob storesCVE-2026-48794Lowgithub.com/authelia/authelia/v4: Authelia has an Edge Case Access Control Rule MismatchGHSA-Q6XX-5VR8-P898Criticalgithub.com/nezhahq/nezha: Nezha vulnerable to cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership checkGHSA-WCR3-9X4C-F5GJHighgithub.com/blnkfinance/blnk: Blnk has an API key authorization bypass in owner and scope enforcementCVE-2026-49342Mediumyard: YARD static cache reads raw traversal paths before router sanitizationCVE-2026-49336Medium@microsoft/kiota-http-fetchlibrary: @microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in…CVE-2026-49293Highjs-toml: js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literalsGHSA-7VFX-4246-JCFHHighsolidinvoice/solidinvoice: SolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settingsCVE-2026-49287Highstatamic/cms: Statamic CMS's unsafe method invocation via collection sorting allows data destructionCVE-2026-49288Mediumstatamic/cms: Statamic CMS: Missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resourcesCVE-2026-49359Mediumpontedilana/php-weasyprint: PhpWeasyPrint vulnerable to SSRF and local file disclosure via the attachment optionCVE-2026-49358Lowpontedilana/php-weasyprint: PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFilesCVE-2026-49286Highpontedilana/php-weasyprint: PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo