Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-106100High@payloadcms/db-mongodb: Payload: Field-level write access bypass in Payload on MongoDBCVE-2026-106123Mediumcom.rabbitmq:amqp-client: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()CVE-2026-106120Mediumliquidjs: LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index,…CVE-2026-106118HighSixLabors.ImageSharp: ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB writeCVE-2026-106117HighImageSharp: ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in…CVE-2026-106454MediumTwisted: Twisted: IMAP wildcardToRegexp() ReDoSCVE-2026-105741Highlangflow: Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration WriteCVE-2026-105681Mediumghost: Ghost: Authorization Bypass in Comments FeatureCVE-2026-105682Lowghost: Ghost: Server-Side Request Forgery in Webhook TriggerCVE-2026-105683Lowghost: Ghost: Path Traversal Vulnerability in Ghost ImageSize ServiceCVE-2026-106452Mediumat.yawk.lz4:lz4-java: yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerCVE-2026-106453Mediumat.yawk.lz4:lz4-java: yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB…CVE-2026-73487Criticalflowise: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator BypassCVE-2026-73483Criticalflowise: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via ChromiumCVE-2026-106105High@quasar/ssl-certificate: Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissionsCVE-2026-106106High@quasar/render-ssr-error: Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassableCVE-2026-106107High@quasar/app-vite: Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrainedCVE-2026-106108Medium@quasar/app-vite: Quasar Framework: App Vite SSG page output paths can escape the configured distribution directoryCVE-2026-106109Medium@quasar/app-vite: Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directoriesCVE-2026-106104Highquasar: Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR serverCVE-2026-106102Criticalquasar: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()CVE-2026-106103High@quasar/icongenie: Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profileCVE-2026-62251Highgithub.com/sipcapture/homer-app: Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/queryCVE-2026-62252Criticalgithub.com/sipcapture/homer-app: Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First LoginCVE-2026-62253Criticalgithub.com/sipcapture/homer-app: Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo