Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-76846Highgetgrav/grav: Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when…CVE-2026-72698Highgetgrav/grav: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_pathsCVE-2026-72701Lowgetgrav/grav: Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protectionCVE-2026-72702Lowgetgrav/grav: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix matchCVE-2026-45140Criticalchamilo/chamilo-lms: Chamilo LMS CStudio upload flow allows unauthenticated remote code executionCVE-2026-68537Highfulgur: Fulgur: Non-painting replaced elements amplify to thousands of blank PDF pages (denial of service)CVE-2026-68523Highfulgur: Fulgur: Unbounded page slicing from attacker-controlled CSS height causes denial of serviceCVE-2026-86039High@libp2p/peer-store: libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addressesCVE-2026-75523MediumSteeltoe.Management.Endpoint: Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secretsCVE-2026-75831Mediumgetgrav/grav: Grav: Stored XSS via Markdown audio/video media <source> URLCVE-2026-86038High@libp2p/gossipsub: libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer IDCVE-2026-72832Mediumgetgrav/grav: Grav: Stored XSS via quoted-attribute bypass in detectXssCVE-2026-85717Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect targetCVE-2026-85720Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT requestCVE-2026-85721Highorg.asynchttpclient:async-http-client: AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of serviceCVE-2026-85716Loworg.asynchttpclient:async-http-client: AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responsesCVE-2026-85756HighSSH.NET: SSH.NET: ScpClient allows server-side RCE via default SCP path handlingCVE-2026-73245Mediumio.kestra:kestra: Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-authCVE-2026-69147Mediumvllm: vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservationCVE-2026-69089Highgetgrav/grav: Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached imagesCVE-2026-69088Highgetgrav/grav: Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosureCVE-2026-85732Mediumoras.land/oras-go/v2: oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probingCVE-2026-85731Highoras.land/oras-go/v2: oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)CVE-2026-73247Highio.kestra:core: Kestra: SSRF via Pebble http() function allows unauthenticated access to internal services & cloud metadataCVE-2026-65608Highgetgrav/grav: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo