Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-96634Mediumadminneo-org/adminneo: AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCECVE-2026-96633Highadminneo-org/adminneo: AdminNeo SQLite Database-List Drop Arbitrary File DeletionCVE-2026-96631Highadminneo-org/adminneo: AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie HeadersCVE-2026-96632Highadminneo-org/adminneo: AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)CVE-2026-96630Highadminneo-org/adminneo: AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)CVE-2026-96629Mediumadminneo-org/adminneo: AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request ForgeryCVE-2026-54442Mediumgov.nsa.emissary:emissary: NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571GHSA-5XJX-3W67-W9X9Criticalpypa/gh-action-pypi-publish: pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPICVE-2026-59978Highadminneo-org/adminneo: AdminNeo: version-cache array injection causes persistent denial of serviceCVE-2026-119284Mediumjoserfc: joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionCVE-2026-119283Highjoserfc: joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionGHSA-F3FJ-9625-RV3MMediumgithub.com/charmbracelet/soft-serve: charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated usersGHSA-FGXM-5HVV-X4VHMediumgithub.com/charmbracelet/soft-serve: charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositoriesCVE-2026-119282High@nx/maven: @nx/maven and @nx/gradle have OS command injection via nx.json plugin optionsCVE-2026-118664Highdecode-uri-component: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runsGHSA-VPP8-G58W-M8MPHighTwisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream ResetCVE-2026-115907Highzip: zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed sizeCVE-2026-115908Highzip: zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. CVE-2026-115906Mediumzip: zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115909Highzip: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionCVE-2026-118662Mediumvite: Vite: `server.fs.deny` bypassed with queriesCVE-2026-63414Highshopify_app: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected appsCVE-2026-62290Highgithub.com/cert-manager/cert-manager: cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentialsCVE-2026-9086Highorg.keycloak:keycloak-services: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypassCVE-2026-9083Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo