Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-3CM4-CCVW-6XR6Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and…CVE-2026-103918Medium@orpc/zod: @orpc/zod: Prototype injection in smart coercionCVE-2026-73802Criticalgitea.com/gitea/runner: gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabledCVE-2026-104861Highprobe-image-size: probe-image-size: Quadratic-time Denial of Service in the SVG ParserGHSA-X8GV-G2G3-65FJHighgithub.com/siyuan-note/siyuan/kernel: SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF)GHSA-P23F-CM6Q-2QP8Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass)CVE-2026-19481High@fastify/busboy: @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part headerCVE-2026-19484High@fastify/busboy: @fastify/busboy vulnerable to Denial of Service via oversized multipart boundaryGHSA-MWM8-39RW-8826Mediumsqlite3: sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument ArrayGHSA-CJCG-CXMH-9WCRHighpraxis-proxy: Praxis affected by HTTP/2 Bomb CVE-2026-71416Highheadroom-ai: Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)CVE-2026-74904Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode…CVE-2026-10032Critical@a2ui/web_core: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actionsCVE-2026-74802Lowgithub.com/siyuan-note/siyuan/kernel: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true`…CVE-2026-104855Lowwasmtime: Wasmtime: Preemption and traps during bulk operations enable breaking internal VM stateGHSA-FJ2X-MQQP-3V2WMediumtrigger.dev: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret valuesCVE-2026-18140Highaws-smithy-json: aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in…GHSA-V2F8-6655-7GRJCriticalvibe-trading-ai: Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chainGHSA-5RMQ-CHC7-M22FHighvibe-trading-ai: Vibe-Trading file-read tools expose arbitrary server-readable filesGHSA-JQMF-MX4F-HFR6Criticalvibe-trading-ai: Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRFGHSA-4672-HWV6-GQ62Mediumtrigger.dev: Trigger.dev: Cross-environment deployment cancelGHSA-9Q4R-4842-93VWHightrigger.dev: Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function nameGHSA-59H8-W5Q6-MFMPMediumtrigger.dev: Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyIdGHSA-PQXW-G93W-HJ9XHightrigger.dev: Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure CompromiseCVE-2026-96780Highfiglet: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo