Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-106451Highat.yawk.lz4:lz4-java: yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userCVE-2026-106449Lowat.yawk.lz4:lz4-java: yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErrorCVE-2026-106450Mediumat.yawk.lz4:lz4-java: yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsCVE-2026-105647Mediumghost: Ghost: Server-Side Request Forgery in Bookmark FetchingCVE-2026-105648Mediumghost: Ghost: Private IP Filtering Bypass via IPv6 Transition AddressesCVE-2026-105649Highghost: Ghost: Stored XSS via SVG Uploads Bypassing SanitizationCVE-2026-105699Highlangflow: Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource HandlersCVE-2026-94544Mediumnext: Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pagesCVE-2026-94543Mediumnext: Next.js has cache poisoning of SSG and ISR pages in self-hosted applicationsCVE-2026-94486Lownext: Next.js has information disclosure in development server's Model Context Protocol endpointCVE-2026-94485Mediumnext: Next.js has information disclosure in App Router metadata image routes via dynamicParams bypassCVE-2026-94484Mediumnext: Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of serviceCVE-2026-94483Highnext: Next.js has Server-Side Request Forgery in Image OptimizationCVE-2026-105856High@payloadcms/db-sqlite: Payload: SQL injection in SQLite/PostgresCVE-2026-105858Highpayload: Payload: Remote Code Execution through first-registerCVE-2026-105860High@payloadcms/plugin-multi-tenant: Payload has a tenant authorization bypass in Multi-Tenant PluginCVE-2026-105861Highpayload: Payload external upload trust validation issueCVE-2026-105862Highpayload: Payload: Bypassed sanitization of user uploaded SVGsCVE-2026-105864Medium@payloadcms/plugin-multi-tenant: @payloadcms/plugin-multi-tenant has a cross-tenant create issueCVE-2026-105865Highpayload: Payload: Incomplete validation during the upload file lifecycleCVE-2026-105866Mediumpayload: Payload: Unauthenticated account-lockout denial of serviceCVE-2026-105867High@payloadcms/storage-s3: Payload: Client uploads could overwrite S3 objectsCVE-2026-105868Highpayload: Payload: Uploaded XML files could execute same-origin JavaScriptCVE-2026-105857Critical@payloadcms/plugin-form-builder: Payload Form Builder has an RCE issueCVE-2026-105859Criticalpayload: Payload: Unauthorized update to collection documents

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo