Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-61741Criticalorg.http4s:http4s-scala-xml_2.12: http4s-scala-xml has an XML External Entity (XXE) processing issueCVE-2026-61784Mediumxhtml-purifier: xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSSCVE-2026-56744High@bsv/wallet-toolbox: `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in…CVE-2026-56738Highphpmyfaq/phpmyfaq: phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word InsertionCVE-2026-56737Highthorsten/phpmyfaq: phpMyFAQ's two-factor authentication login bypasses the password factorCVE-2026-56736Highthorsten/phpmyfaq: phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionGHSA-G28H-2CMM-RJ9XHighlangchain-nvidia-ai-endpoints: langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputsCVE-2026-57439Mediumcyberchef: CyberChef: Prototype pollution in Series Chart operationCVE-2026-61604Criticalgithub.com/ixofoundation/ixo-blockchain/v8: ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypassCVE-2026-61732Criticaldecepticon-core: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM contextCVE-2026-12958High@aws/lsp-codewhisperer: Language Servers for AWS vulnerable to arbitrary file writeCVE-2026-12957High@aws/lsp-codewhisperer: Language Servers for AWS Vulnerable to Arbitrary Code ExecutionGHSA-2JX3-FF3V-J7JJMediumyara-x: yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UBCVE-2026-63498Highsnipe/snipe-it: Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files APICVE-2026-85056Highgithub.com/zitadel/zitadel: ZITADEL: MFA bypass via session reuse in Login V2CVE-2026-85057Highgithub.com/zitadel/zitadel: ZITADEL: Actions V1 sandbox escape: host file read via require()CVE-2026-62368Highsnipe/snipe-it: Snipe-IT: Stored XSS via Custom Field name in asset-list column headersCVE-2026-62286Mediumgithub.com/amir20/dozzle: Dozzle label filters do not restrict container event and statistics streamsCVE-2026-63493Highsnipe/snipe-it: Snipe-IT: 2FA bypass via the API token flowCVE-2026-19730Mediumgithub.com/containers/podman/v5: podman quadlet install --replace does not fully replace the old fileCVE-2026-92164Mediumstreamlink: Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local filesCVE-2026-59167Criticalsuneditor: SunEditor: Critical XSS vulnerability - sanitizer bypassCVE-2026-62998Mediumredaxo/source: REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationCVE-2026-56669Highelysia: elysia has Inefficient Algorithmic Complexity and Interpretation ConflictCVE-2026-61685High@fecommunity/reactpress: ReactPress has SQL injection via dynamic column names in TypeORM query builders

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo