Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-85709Mediumlightrag-hku: lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesCVE-2026-83805Mediumnautobot: Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobsCVE-2026-83801Mediumnautobot: Nautobot: Stored cross-site scripting (XSS) in object create/edit form help textCVE-2026-77528Mediumautobahn: Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflationCVE-2026-76805Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz ModeCVE-2026-76804Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Local File Read via Workflow File-Protocol Gate BypassCVE-2026-76803Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Local File Read via MySQL Client Sandbox BypassCVE-2026-76802Mediumgithub.com/projectdiscovery/nuclei/v3: Nuclei: Arbitrary Command Execution via DAST Code Signature BypassCVE-2026-76819Highgithub.com/projectdiscovery/nuclei/v3: Nuclei: Arbitrary Code Execution via Goja JavaScript Engine VulnerabilityCVE-2026-77561Mediumgithub.com/steveiliop56/tinyauth: Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of serviceCVE-2026-77560Highgithub.com/tinyauthapp/tinyauth: Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach…CVE-2026-77582Mediumgithub.com/tinyauthapp/tinyauth: Tinyauth: User enumeration attack by timing oracleCVE-2026-62371Highgithub.com/kubeedge/kubeedge: KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 APICVE-2026-62370Mediumgithub.com/kubeedge/kubeedge: KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHubCVE-2026-62369Highgithub.com/kubeedge/kubeedge: KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node joinCVE-2026-63131Mediumgithub.com/openbao/openbao: OpenBao Skips Stricter Deny Policy for LIST operationsCVE-2026-63132Criticalgithub.com/openbao/openbao: OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing AttackCVE-2026-71543Highgithub.com/openbao/openbao: OpenBao's Templated Policies Allow Privilege Escalation via Wildcard CharactersCVE-2026-77285Lowgithub.com/openbao/openbao: OpenBao Agent Writes Secrets to StdoutCVE-2026-62182Highgithub.com/kubeedge/kubeedge: KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodesCVE-2026-77426Highunleash-server: Unleash: Missing await on permission check + cross-project IDOR in admin APICVE-2026-77425Mediumunleash-server: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write),…CVE-2026-77258Highmcp-atlassian: MCP Atlassian: Arbitrary file read/exfiltration via upload_attachment missing validate_safe_path()CVE-2026-77250Mediummcp-atlassian: MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissionsCVE-2026-77249Mediummcp-atlassian: MCP Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo