Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-8PCW-H6W9-H46GMediumplone.app.contenttypes: plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename lengthCVE-2026-57576Mediumplone.app.dexterity: plone.app.dexterity has a Denial of Service due to excessive title or description lengthCVE-2026-77394High@openc3/vue-common: OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widgetCVE-2026-82407Highgithub.com/klever-io/klever-go: Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSCVE-2026-82409Highgithub.com/klever-io/klever-go: Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryCVE-2026-82406Highgithub.com/klever-io/klever-go: Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceCVE-2026-76089Highverbb/formie: Formie: Missing authorization on sent notification resend modal exposes submission PIICVE-2026-61814Highorg.typelevel:jawn-parser_2.12: Jawn: Quadratic parsing effort in AsyncParserCVE-2026-59990Highorg.typelevel:jawn-parser_2.12: Jawn: Uncontrolled nesting depth in JSON parserCVE-2026-82405Highgithub.com/klever-io/klever-go: Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated…CVE-2026-86065Highgithub.com/klever-io/klever-go: Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine…CVE-2026-86064Highgithub.com/klever-io/klever-go: Klever-Go: /log controls global node loggingCVE-2026-93421Mediummesop: Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting EndpointCVE-2026-77602Criticalopenc3: OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script…CVE-2026-77601Highopenc3: OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingCVE-2026-61695Highgithub.com/square/wire: Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding serviceCVE-2026-76087Highverbb/formie: Formie: Unauthenticated users can overwrite incomplete submissions via submit actionCVE-2026-76086Highverbb/formie: Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsCVE-2026-92692Mediumsulu/sulu: Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)CVE-2026-77421Mediumorg.jline:jline-builtins: JLine: ReDoS in Nano Editor Regex Search ModeCVE-2026-77422Highorg.jline:jline-builtins: JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` WrappingCVE-2026-56679High9router: 9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgradeCVE-2026-56678Medium9router: 9router: Kiro region injection allows authenticated SSRF with Authorization header forwardingCVE-2026-56676High9router: 9router: Image prefetch DNS rebinding allows SSRF to internal servicesCVE-2026-56675High9router: 9router /v1 APIs has unauthenticated access via reverse proxy locality collapse

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo