Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-64847Mediumanyio: AnyIO process-pool workers can block indefinitely on undrained stderrCVE-2026-63405Mediumgithub.com/anycable/anycable: AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary BodyCVE-2026-58197Highgithub.com/stacklok/toolhive: ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movementCVE-2026-61682Criticalgithub.com/kcp-dev/kcp: kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and…CVE-2026-61833Highzotregistry.dev/zot/v2: zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletionCVE-2026-61795Mediumgithub.com/projectcapsule/capsule: Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook…CVE-2026-61672Highgithub.com/projectcapsule/capsule: Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcementCVE-2026-61794Mediumgithub.com/projectcapsule/capsule: Capsule: Malformed ForbiddenAnnotations.Regex can bypass Tenant validation and trigger namespace admission panicGHSA-39WR-7Q6H-CF68Highlmdeploy: LMDeploy has an SSRF bypassCVE-2026-33625Highlmdeploy: LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadingCVE-2025-66455Criticallmdeploy: LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.pyGHSA-JR78-W6W5-M8F8Highmediawiki/semantic-media-wiki: Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasksGHSA-9RCC-PMJ8-FFHRMediummediawiki/semantic-media-wiki: Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)CVE-2026-77616Mediummediawiki/semantic-media-wiki: Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenCVE-2026-77610Mediummediawiki/semantic-media-wiki: Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)CVE-2026-77609Mediummediawiki/semantic-media-wiki: Semantic MediaWiki has an open redirect in Special:URIResolverCVE-2026-77607Mediummediawiki/semantic-media-wiki: Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSSCVE-2026-77608Mediummediawiki/semantic-media-wiki: Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)CVE-2026-77606Mediummediawiki/semantic-media-wiki: Semantic MediaWiki has reflected XSS in Special:Ask plain table headersCVE-2025-61682Highmediawiki/semantic-media-wiki: Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributesCVE-2025-53837Criticalorg.xwiki.rendering:xwiki-rendering-xml: org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issueCVE-2026-77615Highorg.opencastproject:opencast-engage-paella-player-7: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue textCVE-2026-77281Mediumgithub.com/caddyserver/caddy/v2: Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypassCVE-2026-72819Highgetgrav/grav: Grav CMS vulnerable to remote code execution via .zip file uploadCVE-2026-75837Highgetgrav/grav: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo