Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-96628Mediumgithub.com/getarcaneapp/arcane/backend/v2: Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`CVE-2026-105192Criticallmcache: LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportCVE-2026-100349Highgithub.com/getkin/kin-openapi: kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with contentCVE-2026-58494Mediumwasmtime-wasi: Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationGHSA-6FJ4-RCR3-R7RRHighlopdf: lopdf has a stack overflow via deeply nested PDF objectsCVE-2026-102834Highorg.bytedeco:javacv: JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSCVE-2026-96620Criticalclaude-agent-sdk: Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command ExecutionCVE-2026-62994Lowgithub.com/coredns/coredns: CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` pluginCVE-2026-76894Low@aborruso/ckan-mcp-server: ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)CVE-2026-68549LowClickMigrate: ClickMigrate has Path Traversal in "revision -m" argumentCVE-2026-102941Highgithub.com/gomarkdown/markdown: gomarkdown/markdown IsSafeURL panics on short URLsCVE-2026-102989Critical@tanstack/start-server-core: TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsesCVE-2026-102682Mediumpipecat-ai: Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creationCVE-2026-94603Criticalgo.podman.io/podman/v6: Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationCVE-2026-102832Mediumjupyterlab: JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clickedCVE-2026-103028Mediumgithub.com/drakkan/sftpgo/v2: SFTPGo source-side file-pattern filter bypass during copy operationsCVE-2026-86063High@anthropic-ai/claude-code: Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash PinningCVE-2026-95838Mediumgithub.com/containerd/containerd/v2: containerd: Unpack DoS via repeated opaque whiteoutsCVE-2026-85747Mediumgithub.com/docker/distribution: Distribution: Client `manifests.Get()` does not verify returned content against requested digestCVE-2026-84994High@builder.io/qwik: Qwik: Crashing any Qwik Server via Resource thenableCVE-2026-95837Highgithub.com/containerd/containerd/v2: containerd CRI plugin: Checkpoint restore bypasses destination security contextCVE-2026-106495Medium@backstage/backend-defaults: Backstage: Improper access control in backend action invocationCVE-2026-100353Highgithub.com/getkin/kin-openapi: kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filterCVE-2026-100354Highgithub.com/getkin/kin-openapi: kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo