Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49357Highline-desktop-mcp: Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authenticationCVE-2026-49262Lowaimeos/pagible: Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxyCVE-2026-48995Mediumpnpm: pnpm: Tarball hash of GitHub git dependencies is not stored in lockfileCVE-2026-5223Mediumcargo: Cargo crates in third party registries can override the cached source of other cratesCVE-2026-5222Lowcargo: Cargo can be coerced to share credentials between registriesCVE-2026-49260Highpontedilana/php-weasyprint: php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of…CVE-2026-49258Highgithub.com/juev/nebula-mesh: Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)GHSA-985R-Q3QP-299HHighthorsten/phpmyfaq: phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guardsGHSA-RP72-5V5Q-2446Low@cardano402/mcp-server: @cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.urlCVE-2026-49257Criticalmcp-pinot-server: mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bindCVE-2026-49291Highmcp-memory-service: mcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/callCVE-2026-49252Critical@deepstream/server: deepstream is vulnerable to prototype pollutionGHSA-75MW-H36V-2JV7Mediumdosage: Dosage Vulnerable to Stored Cross-Site Scripting (XSS) in HTML/RSS Output HandlersGHSA-6Q7J-XR26-3H2CMediumScriban: Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 /…GHSA-Q6RR-FM2G-G5X8MediumScriban: Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of…GHSA-V2JF-442R-6MJHLowgithub.com/juev/nebula-mesh: nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + evictionGHSA-Q683-8468-R6H6Mediumweb-auth/webauthn-symfony-bundle: WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logsCVE-2026-48820Mediumcakephp/cakephp: CakePHP: View::element() is missing a path containment checkCVE-2026-48990Mediumjoserfc: joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserializationGHSA-3P34-W4F6-5XH2Highbetter-helperjs: better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static ServerCVE-2026-48979Highphp-standard-library/h2: PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo