Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-68904Highnode-opcua-transport: node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource ExhaustionCVE-2026-61593Highdjust: djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE sessionCVE-2025-59953Criticallmdeploy: LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeployCVE-2026-61595Highdjust: djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' dataCVE-2026-61598Highdjust: djust: Client mass-assignment of arbitrary view attributes via the default dj-model update_model handlerCVE-2026-81192HighOpenTelemetry.Resources.Host: OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOSCVE-2026-61590Highdjust: djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only…CVE-2026-61560Critical@zereight/mcp-gitlab: @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeoverCVE-2026-61559Critical@zereight/mcp-gitlab: @zereight/mcp-gitlab Vulnerable to Server-Side Request ForgeryCVE-2026-61568Critical@zereight/mcp-gitlab: @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transportGHSA-5648-RGJ9-V224High@zereight/mcp-gitlab: @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports,…CVE-2026-61554Highgithub.com/jm33-m0/emp3r0r/core: emp3r0r has an unauthenticated HTTP Polling DoSCVE-2026-88975Highorg.http4s:http4s-ember-core_2.13: Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS_MAX_FRAME_SIZECVE-2026-61544Highlibp2p-quic: libp2p-quic: Remote panic via certificate expiry race during QUIC handshakeCVE-2026-69201Mediumorg.http4s:http4s-server_2.12: Http4s: ResourceService and Webjar Service path escape via percent-encoded separatorsCVE-2026-69218Highorg.http4s:http4s-ember-core_2.12: Http4s Ember HTTP/2: unbounded continuation frame accumulationCVE-2026-69216Mediumorg.http4s:http4s-ember-core_2.12: Http4s: Ember chunk parser lenience (TE.TE request smuggling)CVE-2026-69215Mediumorg.http4s:http4s-client_2.12: Http4s: CookieJar middleware matches by substring, leaking cookies cross-originCVE-2026-69214Mediumorg.http4s:http4s-client_2.12: Http4s: CookieJar middleware accepts arbitrary Set-Cookie domainCVE-2026-69213Highorg.http4s:http4s-ember-core_2.12: Http4s Ember HTTP/2 has an unbounded outbound frame queueCVE-2026-69208Highorg.http4s:http4s-ember-server_2.12: Http4s: DigestAuth nonce map grows unboundedCVE-2026-69206Mediumorg.http4s:http4s-ember-core_2.12: Http4s: DigestAuth allows replay of captured requestsCVE-2026-69205Highorg.http4s:http4s-ember-core_3: Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)CVE-2026-69204Criticalorg.http4s:http4s-ember-core_2.12: Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)CVE-2026-69203Highorg.http4s:http4s-ember-core_2.12: Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo