Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-47W9-6R3F-938GCriticalgithub.com/canonical/lxd: LXD has restricted project bypass leading to arbitrary command executionGHSA-7MR3-28H5-M5VXHighgithub.com/canonical/lxd: LXD has project restriction bypass for custom volume copy across projects GHSA-QX75-2P3R-PWM5Highgithub.com/canonical/lxd: LXD has project restriction bypass in instance copy across projects CVE-2026-55649MediumGeoNode: GeoNode has Stored XSS in Documents metadata abstract fieldCVE-2026-46429MediumGeoNode: GeoNode has Unrestricted File UploadCVE-2026-33050HighGeoNode: GeoNode has OS command injection via uploaded file layer nameCVE-2026-9639Mediumgithub.com/canonical/lxd: LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_atGHSA-PJFF-C2WC-F6JMCriticalgithub.com/canonical/lxd: LXD has arbitrary file write on client due to trusted image hashGHSA-FMC8-P6Q7-75CCCriticalgithub.com/canonical/lxd: LXD has argument injection in backup compression algorithm leading to AFW and ACEGHSA-VGHH-5RFX-XHQ8Criticalgithub.com/canonical/lxd: LXD has arbitrary file read+write on host via rootfs/ symlink in malicious imageGHSA-JPF8-86F3-WP38Criticalgithub.com/canonical/lxd: LXD has arbitrary file read+write on host via templates/ symlink in malicious imageGHSA-9J25-MM2H-2F76Criticalgithub.com/canonical/lxd: LXD has arbitrary file write on host via `exec-output` symlink in crafted imageCVE-2026-28385Mediumgithub.com/canonical/lxd: LXD: SSRF via image import from URL allows internal network probing by authenticated usersCVE-2026-62361Mediumgithub.com/knadh/listmonk: listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentialsCVE-2026-62284Highgithub.com/osac-project/osac-operator: OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxyCVE-2026-16454Mediumorg.eclipse.hawkbit:hawkbit-ddi-resource: Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware ExfiltrationCVE-2026-62300Mediumfilecoin-pin: filecoin-pin: Unbounded DAG pinning can exhaust server resourcesCVE-2026-61536Highbanks: Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCECVE-2026-105769Criticalgithub.com/chainguard-dev/kaniko: kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostsCVE-2026-12411Highgithub.com/canonical/lxd: lxd allows Cross-guest volume hijack via DevLXD device patchCVE-2026-55098Mediumgithub.com/basekick-labs/arc: Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735CVE-2026-93363Medium@payloadcms/storage-vercel-blob: @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapterCVE-2026-113787Mediumodf-kit: odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute valuesCVE-2026-115878Highstanza: Stanza: RCE via pickle deserialization in the lemmatizerCVE-2026-44267Critical@enspirit/elo: Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo