Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-91983Mediumcode.vikunja.io/api: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)CVE-2026-91984Mediumcode.vikunja.io/api: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task…CVE-2026-91985Highcode.vikunja.io/api: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to…CVE-2026-91982Mediumcode.vikunja.io/api: Vikunja: TOTP secret is readable after enrollment, no step-up authCVE-2026-91972Highcode.vikunja.io/api: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limitedCVE-2026-62376Highcode.vikunja.io/api: Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessCVE-2026-62367Highcode.vikunja.io/api: Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeoverCVE-2026-107806Criticalgithub.com/0xJacky/Nginx-UI: Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config OverwriteCVE-2026-107839Highgithub.com/luskaner/ageLANServer/server: ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of ServiceCVE-2026-76216Highcode.vikunja.io/api: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosureCVE-2026-107840Highgithub.com/jhaals/yopass: yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labelsCVE-2026-107841Mediumpacioli-guard: pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documentsCVE-2026-68582Criticalcode.vikunja.io/api: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)CVE-2026-68581Highcode.vikunja.io/api: Vikunja: Link-share principal ID collision allows cross-account API token issuance and managementCVE-2026-57458Highcode.vikunja.io/api: Vikunja: Scoped API token can mint unrestricted OAuth session credentialsGHSA-68W4-83FH-F2W8Highpyload-ng: pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator passwordGHSA-9Q47-3CM2-2RP8Mediumpyload-ng: pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` HeaderGHSA-JQ7H-WRVP-3RGXHighpyload-ng: pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's sessionGHSA-889W-M37P-88M5Highpyload-ng: pyLoad: Api.set_user_permission never invalidates the target's sessionGHSA-P3PR-8F3M-4QP8Mediumpyload-ng: pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification hostGHSA-FR26-JJHM-638CHighpyload-ng: pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)CVE-2026-107812Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMCVE-2026-107808Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)CVE-2026-107809Highgithub.com/0xJacky/Nginx-UI: Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIsCVE-2026-107813Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo