Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-86439Highknowns: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory ToolsGHSA-29H2-JR22-FRMHHigh@openzeppelin/confidential-contracts: OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the…CVE-2026-53493Mediumgithub.com/containerd/containerd/v2: Containerd has image-pull DoS via crafted OCI index graph amplificationCVE-2026-92161Criticalfof/oauth: FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth providerCVE-2026-57440Highstarcitizenwiki/embedvideo: Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabledCVE-2026-61823Highcode16/sharp: code16 Sharp vulnerable to stored XSS via iframe srcdoc AttributeCVE-2026-61825Highcode16/sharp: code16/sharp has a stored XSS via data-html-content Sanitizer BypassCVE-2026-57232Lowcontao/contao: Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader ModuleCVE-2026-57179Mediumsocial-auth-core: social-auth-core has a Session Fixation issueCVE-2026-57178Highsocial-auth-core: social-auth-core: VK App backend accepts unsigned callback data when auth_key is missingCVE-2026-57177Mediumsocial-auth-core: social-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendCVE-2026-57176Mediumsocial-auth-core: social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendCVE-2026-57175Mediumsocial-auth-core: social-auth-core has an Improper Authentication issueCVE-2026-57171Highcompliance-trestle: Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)CVE-2026-57170Highcompliance-trestle: Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)CVE-2026-59723Highcline: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)CVE-2026-61815Highzbateson/mail-mime-parser: zbateson/mail-mime-parser has CRLF header injection via attachment filenameCVE-2026-61816Highzbateson/mail-mime-parser: zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIMECVE-2026-59980Mediumhpack: hpack: Unbounded variable integer decoding can cause run-away computation on malformed inputCVE-2026-61782High@rsdoctor/rspack-plugin: @rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build MetadataCVE-2026-57231Highgithub.com/containers/podman/v5: Podman: Malformed Image can trick podman run into leaking host environment variables into the containerCVE-2026-56742Mediumgithub.com/cilium/cilium: Cilium: Namespaced HTTPRoutes can redirect traffic to other namespacesCVE-2026-61788High@bytebase/dbhub: @bytebase/dbhub's read-only mode does not prevent database writesCVE-2026-61742Critical@bytebase/dbhub: DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo