Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-72809Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxyCVE-2026-72810Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including…CVE-2026-72811Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and…CVE-2026-72812Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated…CVE-2026-85396Highrubyzip: rubyzip path traversal vulnerabilityCVE-2026-85393Highnode-forge: node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elementsCVE-2026-85394Criticalpython-jose: python-jose algorithm confusion guard bypassed by DER-encoded public keysCVE-2026-68584Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)CVE-2026-68585Mediumgithub.com/siyuan-note/siyuan/kernel: SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden…CVE-2026-68586Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of…CVE-2026-68587Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable…CVE-2026-69083Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method…CVE-2026-77465Hightoml: toml-node: Uncontrolled RecursionCVE-2026-63376Hightoml: toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path DesynchronizationCVE-2026-69086Highgithub.com/siyuan-note/siyuan/kernel: SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view…CVE-2026-56812Mediumphoenix: Phoenix: Presence keys colliding with `Object.prototype` members break existence checksCVE-2026-71429Mediumstream-json: stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for…CVE-2026-69084Criticalgithub.com/siyuan-note/siyuan/kernel: SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle,…CVE-2026-79921Highgithub.com/rabbitmq/amqp091-go: amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadCVE-2026-63670Mediumsanitize-html: ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus closeCVE-2026-63669Mediumapostrophe: ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a…CVE-2026-73295Mediummkdocs-material: Material for MkDocs: DOM XSS in search suggestions via query parameterCVE-2026-82404High@toon-format/toon: TOON: Prototype pollution when decoding untrusted TOON inputCVE-2026-73222Highclaude-code-templates: Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo