Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-112942Highlaunch-editor: launch-editor: `fs.existsSync()` existence check can be bypassed on WindowsCVE-2026-111771Medium@modelcontextprotocol/sdk: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another serviceGHSA-HQ85-5CPJ-MR62Criticaluv: uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromisedGHSA-6Q48-6C7W-9GW2Criticalcertifi: certifi bundles emSign root CAs with compromised intermediate CA keysCVE-2026-112943Mediumlaunch-editor: launch-editor: escapeCmdArgs() omits % escaping on WindowsCVE-2026-111767High@modelcontextprotocol/sdk: MCP TypeScript SDK: Experimental tasks were not tied to the session that created themCVE-2026-111769Medium@modelcontextprotocol/sdk: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request…CVE-2026-113653Mediumapostrophe: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)CVE-2026-113665Lowapostrophe: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE EndpointsCVE-2026-113664Medium@apostrophecms/import-export: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring testCVE-2026-113651Lowuploadfs: ApostropheCMS: Path traversal in uploadfsCVE-2026-113657Lowsanitize-html: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)CVE-2026-113652Mediumuploadfs: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)CVE-2026-113660Mediumapostrophe: ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft IdentifiersCVE-2026-113662Medium@apostrophecms/import-export: ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified documentCVE-2026-113659Mediumapostrophe: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersCVE-2026-113710Mediumapostrophe: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password GuessingCVE-2026-113661Mediumsanitize-html: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLsCVE-2026-113668Mediumapostrophe: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated…CVE-2026-113670Mediumapostrophe: ApostropheCMS: Page REST API authorization bypassCVE-2026-113671Medium@apostrophecms/ai-helper: ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRFCVE-2026-113658Highapostrophe: ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryCVE-2026-113669Mediumapostrophe: ApostropheCMS: Cross-domain session token in URL confers session takeoverCVE-2026-113656Medium@apostrophecms/form: ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoSCVE-2026-113667Medium@apostrophecms/form: ApostropheCMS: CAPTCHA response token not URL-encoded

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo