Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-11746Criticalcom.linecorp.centraldogma:centraldogma-server: Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeoverCVE-2026-11748Mediumcom.linecorp.centraldogma:centraldogma-server-auth-shiro: Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication confusion and audit log evasionCVE-2026-59971Criticalmysql-mcp-server: MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)CVE-2026-88006Mediumopen-webui: Open WebUI: Users denied by the OAuth role policy can still sign in via token exchangeCVE-2026-88008Highgithub.com/traefik/traefik/v3: Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect AuthorizationCVE-2026-88004Highgithub.com/traefik/traefik/v3: Traefik entrypoint header-name sanitization bypassed via request trailersCVE-2026-88007Criticalgithub.com/traefik/traefik/v3: Traefik HTTP/3 Backend NTLM Connection ReuseCVE-2026-88009Highgithub.com/traefik/traefik/v3: Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and…CVE-2026-88014Mediumgithub.com/rclone/rclone: rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespaceCVE-2026-88013Lowgithub.com/rclone/rclone: rclone: http backend forwards custom/auth headers to a different host on redirectCVE-2026-88016Mediumgithub.com/rclone/rclone: rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destinationCVE-2026-88015Mediumgithub.com/rclone/rclone: rclone local: crafted Range request against a translated symlink panics (DoS)CVE-2026-88018Criticalgithub.com/rclone/rclone: rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypassCVE-2026-88044Criticalgithub.com/rclone/rclone: rclone: RC per-server auth-proxy bypassCVE-2026-88017Highgithub.com/rclone/rclone: rclone: FTP cross-session auth-proxy backend confusionCVE-2026-88046Mediumgithub.com/rclone/rclone: rclone: source object names can escape the configured root on uploadCVE-2026-88045Highgithub.com/rclone/rclone: rclone: S3 multipart declared-length memory exhaustionCVE-2026-87011Highopen-webui: Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logoutCVE-2026-87012Mediumopen-webui: Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert valueCVE-2026-87013Mediumopen-webui: Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycleCVE-2026-87014Mediumopen-webui: Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notesCVE-2026-59965High@jhb.software/payload-alt-text-plugin: @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` OmissionCVE-2026-59960High@argos-ci/core: @argos-ci/core: CI Branch Name OS Command InjectionGHSA-M3WP-48JR-VR4GHighmistralrs-server-core: mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoSGHSA-WFGQ-W7CQ-QJ7JHighmistralrs-server-core: mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo