Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-73841Highgithub.com/openchoreo/openchoreo: OpenChoreo: Cross-project command execution and wirelog view access via OpenChoreo openchoreo-api exec and wirelogs endpointsCVE-2026-73843Criticalgithub.com/openchoreo/openchoreo: OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIsCVE-2026-67445Highgithub.com/axllent/mailpit: Mailpit: SMTP command parser buffers unbounded command lines before syntax rejectionCVE-2026-72921Highgithub.com/seaweedfs/seaweedfs: SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling pathsCVE-2026-71485Criticalgithub.com/centrifugal/centrifugo: Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backendsCVE-2026-67446Highgithub.com/axllent/mailpit: Mailpit: Thumbnail generation decodes unbounded image dimensions before scalingCVE-2026-84366Highscrapy: Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by defaultCVE-2026-68921Medium@dicebear/core: DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)CVE-2026-62676Highomnigent: Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.pyCVE-2026-65842High@platejs/docx-io: Plate: SSRF with response disclosure in DOCX image embeddingCVE-2026-63490Highcom.github.jknack:handlebars-springmvc: Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypassCVE-2026-63481Mediumhurl: Hurl: Cookies in Cookies section leak when redirecting to a different hostCVE-2026-63435Mediummail: Mail: Email address spoofing via malformed RFC 2047 encoded-wordsCVE-2026-62669Highgetgrav/grav: Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending ChallengeCVE-2026-62677Highomnigent: Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACECVE-2026-62674Criticalomnigent: Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCECVE-2026-62675Highomnigent: Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable ToolsCVE-2026-61842Mediumgetgrav/grav: Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)CVE-2026-61690Mediumgetgrav/grav: Grav: Decompression Bomb via ZipArchiver - Missing Extraction LimitsCVE-2026-61704Highlink-preview-js: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897CVE-2026-75931Highfast-uri: fast-uri vulnerable to host confusion via skipped IDN canonicalization on scheme-relative referencesCVE-2026-75975Highfast-uri: fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizationCVE-2026-75899Highfast-uri: fast-uri vulnerable to server-side request forgery via repeated hostname percent-decodingCVE-2026-76172Highfast-uri: fast-uri vulnerable to host confusion via percent-encoded scheme normalizationCVE-2026-62388Highnltk: NLTK: Default ENFORCE=False Disables All pathsec Security Controls

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo