Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-69202Highorg.http4s:http4s-ember-core_2.12: Http4s Ember HTTP/2: unbounded inbound body bufferingGHSA-RF68-8GJR-36Q7Lowgithub.com/nezhahq/nezha: Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is emptyCVE-2026-32599Mediumgithub.com/gravitl/netmaker: Netmaker has a boolean‑based SQL InjectionCVE-2026-76081Mediumgithub.com/zitadel/zitadel: ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role DeletionsCVE-2026-56668Highgithub.com/zitadel/zitadel: ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token ExchangeCVE-2026-59178Criticalesphome-device-builder: ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgradeGHSA-2XMM-M4WV-3FJHLowoctober/october: October CMS: Incomplete Scheme Validation in Image ResizerCVE-2026-49400Lowoctober/system: October CMS: PHP Object Injection via Backend Widget Session StorageCVE-2026-46696Lowoctober/system: October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder CallsCVE-2026-90771Mediumjoi: joi messages compilation allows prototype replacement through __proto__ error codesCVE-2026-56666Mediumgithub.com/zitadel/zitadel: ZITADEL: Auto-linking by email: IdP-side email verification is not checkedCVE-2026-61534Criticalyayson: yayson: Prototype pollution in Store/LegacyStore deserializationCVE-2026-59148High@mockoon/commons-server: @Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theftCVE-2026-59149Medium@mockoon/commons-server: @Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)CVE-2026-59973Highmcp-from-openapi: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fixCVE-2026-59151Criticalprowler-cloud: Prowler: SAML Domain Claiming Enables Cross-Tenant Account TakeoverCVE-2026-56665Mediumgithub.com/zitadel/zitadel: ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP ProviderCVE-2026-56825Highshopper/framework: Shopper: Missing authorization on product removal actions in CollectionProducts componentCVE-2026-56830Mediumshopper/framework: Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)CVE-2026-56829Highshopper/framework: Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock componentCVE-2026-56828Highshopper/framework: Shopper: privilege escalation via improper Livewire admin component authorizationCVE-2026-56826Mediumshopper/framework: Shopping privilege escalation through missing authorization in Settings componentsCVE-2026-56831Mediumshopper/framework: Shopper: Negative discount values accepted and propagated through order calculation pipelineCVE-2026-56827Highshopper/framework: Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility…CVE-2026-11745Highcom.linecorp.centraldogma:centraldogma-server-mirror-git: Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo