Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-9799Mediumorg.keycloak:keycloak-services: Keycloak allows unauthorized access to resources via uma permission ticket bypassCVE-2026-9800Highorg.keycloak:keycloak-services: Keycloak vulnerable to authorization bypass via incorrect uri comparisonCVE-2026-9705Mediumorg.keycloak:keycloak-services: Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenGHSA-W9X9-J56R-H98RHigh@eeacms/volto-chatbot: @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy ProxyCVE-2026-61848Mediumcrass: Crass: Non-ASCII characters cause superlinear CPU consumptionCVE-2026-61847Mediumcrass: Crass: A large number of adjacent CSS comments can trigger a SystemStackErrorCVE-2026-61846Mediumcrass: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usageGHSA-C33X-VCV4-VG3GLowcedar-policy: Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergenceCVE-2026-62264High@sylphx/pdf-reader-mcp: @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYCVE-2026-61438Highpraisonai: PraisonAI vulnerable to Remote Code Execution via Broken AST SandboxCVE-2026-61448Lowparse-server: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklistCVE-2026-62160Highgithub.com/daptin/daptin: Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewareGHSA-PG53-P7QP-65CVLowpocketmine/pocketmine-mp: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packetsCVE-2026-55186Mediumsilverstripe/mfa: MultiFactor Authentication for SilverStripe can bypass MFA during password reset flowCVE-2026-115927Mediumtornado: Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunksCVE-2026-116578Lowtornado: Tornado: Open redirect in RedirectHandler via protocol-relative URLsCVE-2026-116577Mediumtornado: Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingCVE-2026-116695Mediumcrass: Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypassCVE-2026-116576Highsysteminformation: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marksCVE-2026-115923Medium@backstage/plugin-catalog-backend: Backstage catalog rules can be bypassed for URL locations using encoded path segmentsCVE-2026-117601Criticalelectrum: Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing itGHSA-2HW4-C9M4-F2FJMediumknative.dev/pkg: knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustionGHSA-JF75-Q64Q-G65RMedium@waline/vercel: Waline login accepts a non-string email as a match-all MongoDB queryCVE-2026-116583Mediumseroval: Seroval: Code injection through a typed array's own constructor propertyCVE-2026-116582Mediumseroval: Seroval: Script injection through RegExp sources in serialized output

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo