Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-86076Highn8n: n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code ExecutionCVE-2026-87017Mediumopen-webui: Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backendsCVE-2026-87994Mediumopen-webui: Open WebUI: Channel members can overwrite another member's message via the chat completions endpointCVE-2026-87995Highopen-webui: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originCVE-2026-87996Highopen-webui: Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loaderCVE-2026-87997Mediumopen-webui: Open WebUI: Any authenticated user can inject chats into another user's folder via chat completionsCVE-2026-87998Highopen-webui: Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletionCVE-2026-87999Highopen-webui: Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetchCVE-2026-88005Mediumopen-webui: Open WebUI: Users denied by the OAuth domain allowlist or role policy can still sign in via token exchangeCVE-2026-59161Highgithub.com/xuri/excelize/v2: Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocationCVE-2026-59162Mediumgithub.com/xuri/excelize/v2: Excelize: Negative shared-string index causes panic in GetCellValue and GetRowsGHSA-X7M8-JRM8-HPVXHigh@eigenpal/docx-editor-core: @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family nameCVE-2026-84939Criticalorg.freemarker:freemarker: Apache FreeMarker template loading mechanism vulnerable to path traversalCVE-2026-88000Mediumopen-webui: Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat treeCVE-2026-88001Mediumopen-webui: Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targetsCVE-2026-88002Mediumopen-webui: Open WebUI: Any authenticated user can hang the server via a cyclic chat message historyCVE-2026-59185Highgithub.com/identrail/identrail: Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verificationCVE-2026-59179High@openhop/server: @openhop/server: Path Traversal in Flow ID File OperationsCVE-2026-59177Highesphome-device-builder: ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfacesCVE-2026-59176Highfunctype-mcp-server: functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic ImportCVE-2026-59172Highgithub.com/candid82/joker: Joker linter executed project-local .jokerd/linter.* files during lintingGHSA-HXJG-93WC-H8P8Highgithub.com/komari-monitor/komari: Komari: Management Interface CSRFCVE-2026-59160High@yeger/turbo-graph: @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/runCVE-2026-59158Highnuxt-ollama: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser ClientsCVE-2026-59157Mediumgithub.com/ncarlier/webhookd: webhookd: Unrestricted HTTP Header to Shell Variable Injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo