Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-69190Mediumorg.graylog2:graylog2-server: Graylog: Manager-to-Owner privilege escalation on saved searches and dashboardsCVE-2026-77322Highgithub.com/emiago/sipgo: SIPGO: DoS via unvalidated WebSocket frame lengthCVE-2026-65829MediumMPXJ.Net: MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readersCVE-2026-61570Highnet.sf.mpxj:mpxj: MPXJ: XXE Vulnerability in MerlinReaderCVE-2026-62987Mediumgithub.com/fabiolb/fabio: Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection…CVE-2026-63628Mediummppx: mppx: Gas Draining with access listCVE-2026-63627Mediummppx: mppx: Gas Draining with paddingCVE-2026-63342Mediumgithub.com/hatchet-dev/hatchet: Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization CheckCVE-2026-61681Mediumgithub.com/hatchet-dev/hatchet: Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation HandlerCVE-2026-62364Lowwlc: wlc may disclose API tokens to project-configured URLsCVE-2026-58268Highgithub.com/emiago/sipgo: SIPGO: DoS via unvalidated Content-Length in the stream parserCVE-2026-63116High@deepstream/server: deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writesCVE-2026-62985Highrequest-filtering-agent: request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the…CVE-2026-62866Mediumgithub.com/tomwright/dasel/v3: Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`CVE-2026-59168Mediumgithub.com/tomwright/dasel/v3: Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoSCVE-2026-62282Mediumopencve: OpenCVE: Server-Side Request Forgery (SSRF) in notificationsCVE-2026-59991Highpsd-tools: psd-tools composite/numpy has uncontrolled memory allocation via crafted PSD geometryCVE-2026-61670Mediummicrosandbox: microsandbox: Secret values exposed in world-readable process argumentsCVE-2026-56682Medium9router: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip HeaderCVE-2026-56681High9router: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip HeaderCVE-2026-61612Medium@aborruso/ckan-mcp-server: @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509CVE-2026-58272Medium@sync-in/server: Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack…CVE-2026-58270Medium@sync-in/server: Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`CVE-2026-58269High@sync-in/server: Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`CVE-2026-58271Medium@sync-in/server: @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo