Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-84321Mediumgithub.com/0xJacky/Nginx-UI: Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableCVE-2026-84316Highgithub.com/0xJacky/Nginx-UI: Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive…CVE-2026-59951Mediummcp: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionCVE-2026-62858Mediumyourls/yourls: YOURLS: Unauthenticated File InclusionCVE-2026-84312Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Casdoor SSO callback uses a constant `state` parameter (login CSRF)CVE-2026-84315Highgithub.com/0xJacky/Nginx-UI: Nginx UI OTP secure-session step-up is missing on sensitive mutation routesCVE-2026-84314Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management EndpointCVE-2026-84313Highgithub.com/0xJacky/Nginx-UI: Nginx UI: TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeoverCVE-2026-84318Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCECVE-2026-84317Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)CVE-2026-84320Mediumgithub.com/0xJacky/Nginx-UI: Nginx UI: Auto backup name allows path traversal outside validated storage pathCVE-2026-84319Highgithub.com/0xJacky/Nginx-UI: Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx…CVE-2026-104827Highreact/http: react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoSCVE-2026-104150Medium@adonisjs/http-server: AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityCVE-2026-97370Highcom.github.junrar:junrar: Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extractionCVE-2026-77622Highgithub.com/BishopFox/sliver: Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderCVE-2026-62268Mediumborgbackup: borg extract might modify out-of-tree files when extracting maliciously crafted archivesCVE-2026-62322Mediumsocial-auth-core: Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)CVE-2026-92707MediumMessagePack: MessagePack: Nested arrays can blow past buffer length limitsCVE-2026-64672Mediumgithub.com/gruntwork-io/terragrunt: Terragrunt catalog predictable temp symlink clobberCVE-2026-64655Lowgithub.com/cli/cli/v2: GitHub CLI allows attestation verification bypass through unescaped regex metacharactersCVE-2026-64653Lowgithub.com/cli/cli/v2: GitHub CLI allows path traversal through unescaped request URL componentsCVE-2026-64652Lowgithub.com/cli/cli/v2: GitHub CLI partially discloses authentication tokens in `gh auth status` outputCVE-2026-72923HighMicrosoft.OpenApi.YamlReader: Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansionCVE-2026-14966Lowbbot: BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo