Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-71415Highgetkirby/cms: Kirby: File upload permissions are not checked during processing of chunk dataCVE-2026-75594Highgetkirby/cms: Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handlingCVE-2026-45822Mediumdecode-uri-component: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded inputCVE-2026-59724Highengine.io: Socket.IO: Engine.IO WebTransport SID DoSCVE-2026-81888Medium@hono/oauth-providers: @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linkingCVE-2026-81889Highstudio-42/elfinder: elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallbackCVE-2026-15305Mediumtypo3/cms-form: TYPO3 CMS - Unrestricted File Upload in Form FrameworkCVE-2026-55855Mediummariadb: MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsetsCVE-2026-55830HighRestrictedPython: RestrictedPython guard hooks can be shadowed via positional-only argumentsCVE-2026-55860Mediumorg.mariadb:r2dbc-mariadb: org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a…CVE-2026-55859Mediumorg.mariadb:r2dbc-mariadb: org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of OutputCVE-2026-55858Mediumorg.mariadb.jdbc:mariadb-java-client: org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output ContextCVE-2026-55857Mediumorg.mariadb.jdbc:mariadb-java-client: org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected CredentialsCVE-2026-55856Mediumorg.mariadb.jdbc:mariadb-java-client: MariaDB has cleartext password disclosure to a MITM on the initial-handshakeCVE-2026-55843Highsnipe/snipe-it: Snipe-IT has an Improper Privilege Management issueCVE-2026-55848Highorg.mapfish.print:print-lib: MapFish Print has XXE that allows reading arbitrary files of certain typesCVE-2026-55785Lowgithub.com/free5gc/ausf: free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKACVE-2026-55784Highgithub.com/free5gc/ausf: free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPICVE-2026-55779Mediumsilverstripe/versioned: silverstripe/versioned has XSS in archive admin restoreCVE-2026-55874Highgithub.com/seaweedfs/seaweedfs: SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object readCVE-2026-55873Mediumgithub.com/seaweedfs/seaweedfs: SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned…CVE-2026-55867Mediumorg.graylog2:graylog2-server: Graylog token revocation endpoint allows authenticated users to delete other users’ access tokensCVE-2026-55841Highorg.graylog2:graylog2-server: Fortigate syslog message parser can be exploited to modify or delete fields from the original messageCVE-2026-55764Highgithub.com/klever-io/klever-go: klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupplyCVE-2026-55854Mediummariadb: MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo