Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-100352Highgithub.com/getkin/kin-openapi: kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation PathCVE-2026-77564Lowgithub.com/siderolabs/talos: Talos Linux: Support bundle does not redact registry credentialsCVE-2026-77524Criticalgithub.com/kedacore/keda: KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthenticationCVE-2026-77459Criticalgithub.com/argoproj/argo-cd/v2: Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksCVE-2026-100351Highgithub.com/getkin/kin-openapi: kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusionCVE-2026-103975Medium@appium/support: Appium: Symlink based Zip Slip in @appium/support ZIP extractionCVE-2026-103030Highdio_http2_adapter: Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`CVE-2026-100350Mediumgithub.com/getkin/kin-openapi: kin-openapi deepObject query decoding repeatedly compiles an invariant regular expressionCVE-2026-102748Criticalgithub.com/dgraph-io/dgraph/v25: Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of ServiceCVE-2026-104266Mediumtinytag: tinytag: Infinite loop when parsing certain M4A files containing invalid atomsCVE-2026-104102Mediumcopyparty: copyparty FTP: upload outside defined volumes (limited path traversal)CVE-2026-104252Criticalvitess.io/vitess: Vitess vttablet /twopcz reflected XSSCVE-2026-104250Mediumunstructured: unstructured: Stored XSS via unescaped HTML generationCVE-2026-103929Highmise: mise permits untrusted local configuration to override default shell argumentsCVE-2026-100348Mediumgithub.com/getkin/kin-openapi: kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)CVE-2026-100347Mediumgithub.com/getkin/kin-openapi: kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static pathCVE-2026-102603Mediumgithub.com/gotify/server/v2: Gotify: Insufficiently Protected Password Change endpointCVE-2026-102527Mediumnuxt-og-image: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesCVE-2026-100409High@opennextjs/cloudflare: OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsCVE-2026-100394Mediumgithub.com/nezhahq/nezha: Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantCVE-2026-97394Highgithub.com/getkin/kin-openapi: kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing itemsCVE-2026-85990Highleantime/leantime: Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC MethodsCVE-2026-82416Highgithub.com/dunglas/frankenphp: FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleCVE-2026-77375Mediumgithub.com/drakkan/sftpgo/v2: SFTPGo: Denial of service via malformed SSH channel requestCVE-2026-84360Highgithub.com/0xJacky/Nginx-UI: Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo