Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-61647High@roomi-fields/notebooklm-mcp: @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directoryCVE-2026-61628Highgithub.com/lucasdillmann/nginx-ignition: nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race ConditionCVE-2026-61629Highgithub.com/lucasdillmann/nginx-ignition: nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in…CVE-2026-61630Mediumgithub.com/lucasdillmann/nginx-ignition: nginx ignition has TOTP Reuse During Validity WindowGHSA-JHJP-4C2Q-XMX4Mediumgithub.com/falcosecurity/plugins/plugins/k8saudit: k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containersCVE-2026-61687Highgithub.com/hatchet-dev/hatchet: Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthStateCVE-2026-93749Highsource-map-js: source-map-js allows event-loop denial of service through indexed source-map section offsetsCVE-2026-93753Lowdeepmerge: deepmerge mergeObject() allows prototype poisoning of returned objectsGHSA-JGH3-FGGC-MCPMHighgithub.com/obot-platform/obot: Obot: Server-Side Request Forgery via remote MCP server URLGHSA-PR6H-VR44-XQ8JMediumgithub.com/obot-platform/obot: Obot: MCP Registry API readable without authenticationGHSA-XWMW-PRC4-V3CRHighgithub.com/obot-platform/obot: Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience ConfusionCVE-2026-71537Mediumpaymenter/paymenter: Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade)CVE-2026-85058Highio.moquette:moquette-broker: io.moquette:moquette-broker has a Missing Authorization issueCVE-2026-59163Criticalmnemosyne-memory: Mnemosyne has JWT signature verification bypass sync server that allows authentication bypassCVE-2026-63445Highgithub.com/perses/perses: Perses's unvalidated project parameter enables filesystem path traversalCVE-2026-63199Highgithub.com/perses/perses: Perses's missing authorization in datasource proxy allows cross-scope secret disclosureCVE-2026-63458Highgithub.com/perses/perses: Perses's project query parameter authorization bypass exposes cross-project resourcesCVE-2026-91127High@file-viewer/doc: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererCVE-2026-77301Highadm-zip: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)CVE-2026-77339Mediumgithub.com/f1bonacc1/process-compose: Process Compose: Browser DNS rebinding lets websites control local process-compose MCP toolsCVE-2026-81505Highgithub.com/frain-dev/convoy: Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker CredentialsCVE-2026-84992Mediummd-editor-v3: md-editor-v3: XSS via fenced-code language rendering bypassCVE-2026-63406Mediumgithub.com/anycable/anycable: AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including SecretsCVE-2026-63349Highanyio: AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsCVE-2026-63374Criticalanyio: AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo