Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-77420Mediumorg.jline:jline-reader: JLine: ReDoS via `HISTORY_IGNORE` Configuration VariableCVE-2026-85724Criticalio.moquette:moquette-broker: Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message…CVE-2026-73858Mediumsolspace/craft-freeform: Solspace Freeform: Limited Twig template injection via submitted field valuesCVE-2026-88974Mediumwp-graphql/wp-graphql: WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePostCVE-2026-63000Mediumredaxo/source: REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon UpdatesCVE-2026-63002Mediumredaxo/source: REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem FilenamesCVE-2026-63001Mediumredaxo/source: REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`CVE-2026-61541Mediumzapros: Zapros has an Unbounded Content-Encoding decompression chain that allows denial of serviceCVE-2026-61652Highzapros: Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory…CVE-2026-57149Criticalplone.app.portlets: plone.app.portlets Vulnerable to Remote Code Execution via TALES InjectionCVE-2026-91130Criticalhomeassistant: Home Assistant: XSS in Statistics Graph CardCVE-2026-91129Mediumhomeassistant: Home Assistant: mDNS Server-Side Request ForgeryCVE-2026-88010Mediumgithub.com/traefik/traefik/v3: Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracleCVE-2026-88978Mediumgithub.com/hatchet-dev/hatchet: Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterCVE-2026-84298Lowgithub.com/hatchet-dev/hatchet: Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherCVE-2026-79913Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and…CVE-2026-79767Mediumgithub.com/gardener/gardener: Gardener: Authorization Bypass via Group Subject InjectionCVE-2026-77637Lowgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth ScopeCVE-2026-77633Highgithub.com/cloudreve/Cloudreve/v4: Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceCVE-2026-94462Highspree_api: Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)CVE-2026-86062Mediumlightrag-hku: lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentCVE-2026-85740Highlightrag-hku: lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guardCVE-2026-85734Criticallightrag-hku: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksCVE-2026-85725Mediumlightrag-hku: lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo