Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55678Mediumgithub.com/basekick-labs/arc: arc has unauthenticated cluster node admission when `cluster.shared_secret` is unsetCVE-2026-55761Highgithub.com/portainer/portainer: Portainer has Unauthenticated Restore Endpoint that Allows Admin Takeover on Uninitialized InstancesCVE-2026-55763Highgithub.com/klever-io/klever-go: klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splitsCVE-2026-55891Lowprivatebin/privatebin: PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URICVE-2026-55696Mediumprivatebin/privatebin: PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required…GHSA-73P9-6HRP-8QHRMediumaiir: AIIR verification and policy gates could report success without enforcing the control (fail-open)CVE-2026-55484Highgithub.com/guno1928/alos-http: alos-http has unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing…CVE-2026-55634Criticalpimcore/pimcore: Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field NameCVE-2026-55220Criticalpimcore/pimcore: Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)CVE-2026-55212Highpimcore/studio-backend-bundle: Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege EscalationCVE-2026-55208Highpimcore/studio-backend-bundle: Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password…CVE-2026-55207Highpimcore/studio-backend-bundle: Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypassCVE-2026-55215Highmariadb: MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`CVE-2026-55247Criticalplone.app.event: plone.app.event vulnerable to denial of service via iCalendar importCVE-2026-55622Highgithub.com/lxc/incus/v7/cmd/incusd: Incus has a project restriction bypass in instance copy across projectsCVE-2026-55621Highgithub.com/lxc/incus/v7: Incus has a project restriction bypass for custom volume copy across projectsCVE-2026-55228HighWeblate: Weblate has IDOR in GroupViewSet that allows authenticated project manager to gain unauthorized read access to any private projectCVE-2026-55227Mediumweblate: Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookupsCVE-2026-55520HighProtego: Protego has exponential backtracking ReDoS in robots.txt URL wildcard matchingCVE-2026-55248Criticalplone.app.portlets: plone.app.portlets vulnerable to denial of service via RSS feed portletCVE-2026-55673Highcom.powsybl:powsybl-computation-local: PowSyBl Core has Command Injection in LocalCommandExecutor-sCVE-2026-55175Highio.spinnaker.rosco:rosco-manifests: Spinnaker: Improper yaml processing on kustomize bake operationsCVE-2026-55407Mediumbuffa: Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationCVE-2026-55406Mediumbuffa: Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in DerefCVE-2026-55641High9router: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo