Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-105863Criticalpayload: Payload authentication token field handling issueCVE-2026-105650Highghost: Ghost: Stored XSS via oEmbed Photo ResponsesCVE-2026-105651Highghost: Ghost: Stored XSS via Bookmark Card ImagesCVE-2026-105652Lowghost: Ghost: Password Hash Ordering Disclosure in Ghost Admin APICVE-2026-105675Highghost: Ghost: Invite Token Disclosure in Ghost Admin APICVE-2026-105676Mediumghost: Ghost: Path Traversal via Locale SettingCVE-2026-105677Highghost: Ghost: Remote Code Execution via Theme Translation FilesCVE-2026-105678Mediumghost: Ghost: Editors Could Promote Staff Users to Their Own RoleCVE-2026-105679Highghost: Ghost: Stored XSS via File Uploads on Local StorageCVE-2026-106122Mediumcom.rabbitmq:amqp-client: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumersCVE-2026-106457Medium@backstage/plugin-auth-backend-module-cloudflare-access-provider: Backstage: Insufficient audience validation in the Cloudflare Access auth providerCVE-2026-106455High@backstage/plugin-techdocs-node: Backstage: Improper validation of MkDocs plugin configuration in TechDocsCVE-2026-106456Medium@backstage/plugin-proxy-backend: Backstage: Inconsistent credential enforcement for overlapping proxy routesCVE-2026-106458Medium@backstage/plugin-catalog-backend-module-bitbucket-server: Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updatesCVE-2026-106459High@backstage/plugin-scaffolder-backend-module-sentry: Backstage: Improper input validation in Sentry scaffolder actionsCVE-2026-106115HighSixLabors.ImageSharp: ImageSharp: TIFF CCITT T6 encoder writes beyond an undersized output bufferCVE-2026-106111MediumSixLabors.ImageSharp: ImageSharp: EXR ZIP decoder can expose stale allocator data after a short inflateCVE-2026-106112HighSixLabors.ImageSharp: ImageSharp: ICC LUT16 output channel count can write beyond Vector4CVE-2026-106116MediumSixLabors.ImageSharp: ImageSharp: BigTIFF IFD count can keep a decoder thread in a non-progressing loopCVE-2026-106110HighSixLabors.ImageSharp: ImageSharp: TIFF CCITT T4 encoder can write past its compressed output bufferCVE-2026-106113HighSixLabors.ImageSharp: ImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram indexCVE-2026-106114MediumSixLabors.ImageSharp: ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensionsCVE-2026-106440Highhydra-optuna-sweeper: Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_methodCVE-2026-106439Highhydra-core: Hydra: Mutable instantiate policy sets allow target blocklist bypassCVE-2026-106460Medium@backstage/plugin-auth-node: Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo