Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107811Highgithub.com/0xJacky/Nginx-UI: 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUserCVE-2026-107807Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Node Secret Credential Exposure via URL Query ParameterCVE-2026-107810Highgithub.com/0xJacky/Nginx-UI: Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliedGHSA-R44W-V6GF-X3P6Highpyload-ng: pyLoad has an authentication bypass in API key validation (check_apikey cache)CVE-2026-75597Mediumpyload-ng: pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via…CVE-2026-55797Highgithub.com/argoproj/argo-cd/v2: Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLCVE-2026-48484Mediumpyload-ng: pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process TerminationCVE-2026-107727Lowstrawberry-graphql: Strawberry legacy graphql-ws retains naturally completed subscription slotsCVE-2026-107728Highstrawberry-graphql: Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyCVE-2026-107719Mediumfast-jwt: fast-jwt: Verifier cache accepts expired JWTs without iat.CVE-2026-107726Criticalcom.hazelcast:hazelcast: Hazelcast allows arbitrary member memory access by low-privileged clientCVE-2026-107716Mediumbanks: Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistryCVE-2026-107717Mediumbanks: Banks: User-controlled prompt input can be parsed as privileged chat messagesCVE-2026-107394Mediumindico: Indico: Incomplete Server-Side Request Forgery (SSRF) checkCVE-2026-107395Mediumindico: Indico: Missing access check in legacy session export APICVE-2026-107397Mediumindico: Indico: Cross-Site-Scripting in minutes editorCVE-2026-107396Mediumindico: Indico: Cross-Site-Scripting in link fieldsCVE-2026-107725Highcom.hazelcast:hazelcast: Hazelcast has an authorization bypass in IMap Predicates APICVE-2026-107718Medium@adonisjs/http-server: AdonisJS: Unencoded route parameters can produce open redirectsCVE-2026-107399Mediummechanize: Mechanize sends credential headers to another origin after a meta refreshCVE-2026-107715Mediummechanize: Mechanize sends credential headers to another host after an HTTP redirectCVE-2026-107720Highfast-jwt: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setCVE-2026-107722Criticalfast-jwt: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionCVE-2026-107721Mediumfast-jwt: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)CVE-2026-107723Highfast-jwt: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo