Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107805Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storageCVE-2026-107804Mediumgithub.com/0xJacky/Nginx-UI: Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockoutCVE-2026-108259High@tinacms/cli: Tina: Code injection via unescaped Git branch name in generated client sourceCVE-2026-108261Criticaltinacms: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentCVE-2026-108260High@tinacms/web-components: @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSCVE-2026-108258Mediumshiny: Shiny for Python has path traversal in bookmark restoreGHSA-W2CH-4XGR-22WWLowcode.vikunja.io/api: Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removalGHSA-8WVG-R2J4-3737Mediumcode.vikunja.io/api: Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpointGHSA-3HC7-R24J-RPWCMediumcode.vikunja.io/api: Vikunja: Cross-project task disclosure through subtask expansionGHSA-G38J-7V97-X298Mediumcode.vikunja.io/api: Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UIDCVE-2026-107842Mediumcontao/core-bundle: Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledCVE-2026-107843Mediumcontao/core-bundle: Contao: The registration module re-sends activation mailsCVE-2026-107848Lowcontao/core-bundle: Contao: Cross-site request forgery in custom backend actionsCVE-2026-107844Mediumcontao/core-bundle: Contao: Path traversal in the images controllerCVE-2026-107845Criticalcontao/comments-bundle: Contao: Cross-site scripting in the comments bundleCVE-2026-107850Mediumcontao/core-bundle: Contao: Improper access control in the preview links moduleCVE-2026-107851Mediumcontao/core-bundle: Contao: Improper access control in the table access voterCVE-2026-91970Highcode.vikunja.io/api: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the APICVE-2026-91969Highcode.vikunja.io/api: Vikunja: Unbounded CSV row cardinality permits API process terminationCVE-2026-91968Highcode.vikunja.io/api: Vikunja: Unbounded nested task-filter recursion permits API process terminationCVE-2026-91979Highcode.vikunja.io/api: Vikunja: Denial of service via decompression bomb in the data importCVE-2026-91981Mediumcode.vikunja.io/api: Vikunja: Link-share token can enumerate users through the v2 APICVE-2026-91980Mediumcode.vikunja.io/api: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway projectCVE-2026-91971Highcode.vikunja.io/api: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplificationCVE-2026-91973Mediumcode.vikunja.io/api: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo