Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-75513CriticalMarten: Marten's LINQ provider has SQL injection via unescaped string literalsCVE-2026-59823Mediumlitellm: LiteLLM Proxy has server-side request forgery via the `user_config` request parameterCVE-2026-71538High@cyclonedx/cyclonedx-npm: @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on WindowsCVE-2026-63472Critical@vendure/core: Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verificationCVE-2026-63461Medium@vendure/core: Vendure: Shop API list queries can return non-public entities when filterOperator is ORCVE-2026-63460High@vendure/core: Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backendsCVE-2026-63459High@vendure/dashboard: Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptionsCVE-2026-61793Mediumnuxt-og-image: Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameterCVE-2026-64684Mediumrmcp: RMCP: Custom HTTP headers leak to cross-origin redirect targetsCVE-2026-61709Mediumgithub.com/openfga/openfga: OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with…CVE-2026-58657Mediumgetgrav/grav: Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in GravCVE-2026-63671High@nuxtjs/mdc: @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configurationCVE-2026-63128Highrmcp: RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-serviceCVE-2026-63127Highrmcp: RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata DiscoveryCVE-2026-61453Mediumgetgrav/grav: Grav: XSS Blueprint Validation Bypass via Twig String ConcatenationCVE-2026-57173Mediumvllm: vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completionsCVE-2026-59193Mediumgetgrav/grav: Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()CVE-2026-61599Highdjust: djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount pathCVE-2026-61589Mediumdjust: djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on…CVE-2026-61596Highdjust: djust has broken object-level access control (IDOR)CVE-2026-61588Mediumdjust: djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute…CVE-2026-61594Criticaldjust: djust has an authorization bypass on the WebSocket/SSE mount pathCVE-2026-61591Highdjust: djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)CVE-2026-61592Highdjust: djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session…CVE-2026-61597Mediumdjust: djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo