Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-86043Highgithub.com/zalando/skipper: Skipper has OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix GHSA-8qqm-fp2q-v734)CVE-2026-77412Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client CVE-2026-77411Criticalgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr CVE-2026-77410Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation CVE-2026-77408Criticalgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow CVE-2026-77407Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields CVE-2026-77406Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration CVE-2026-77405Criticalgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser CVE-2026-77404Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection CVE-2026-77403Highgithub.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation CVE-2026-86071Lowcom.github.junrar:junrar: Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root CVE-2026-77401MediumAccessControl: Zope AccessControl vulnerable to information disclosure through Python string `format` and `format_map` functions CVE-2026-76825HighRestrictedPython: RestrictedPython vulnerable to sandbox escape via string.Formatter field resolution CVE-2026-85715Highexifreader: ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion CVE-2026-61700Loworg.mariadb.jdbc:mariadb-java-client: MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests CVE-2026-69197HighUmbraco.Cms: Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion CVE-2026-85078Mediumsanic: sanic chunked trailer request smuggling allows hidden second request execution CVE-2026-63506High@tinacms/auth: Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site CVE-2026-63225Medium@redocly/cli: Redocly CLI: Path traversal when using `split` command CVE-2026-82410Highgithub.com/pocketbase/pocketbase: Pocketbase: Unhandled panic in worker goroutines CVE-2026-61449Mediumgetgrav/grav: Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer CVE-2026-62949Mediumasyncssh: AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION CVE-2026-63126Highcom.squareup.wire:wire-runtime: Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)CVE-2026-77360Medium@orpc/server: oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass CVE-2026-75516Highcom.rabbitmq:amqp-client: RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo