Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-55638High9router: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass CVE-2026-55584Highphpsysinfo/phpsysinfo: phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers CVE-2026-55245Highgithub.com/maximhq/bifrost/core: Bifrost's SSRF deny-list is incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL CVE-2026-55588Loworas.land/oras: ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption CVE-2026-55485Highpiccolo-admin: piccolo-admin has a privilege escalation issue - admin to superuser via session-token disclosure in GET /api/tables/sessions/.CVE-2026-55509HighWsgiDAV: WsgiDAV MySQL provider has a blind SQL injection CVE-2026-55425Mediumorg.graylog2:graylog2-server: Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields CVE-2026-55516Highsnipe/snipe-it: Snipe-IT vulnerable to cross-company asset maintenance re-parenting via API update CVE-2026-55515Mediumsnipe/snipe-it: Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint CVE-2026-55481Mediumsnipe/snipe-it: Snipe-IT has CSS Injection via `header_color` Setting CVE-2026-55479Mediumsnipe/snipe-it: Snipe-IT has incorrect permission for legacy license checkin API CVE-2026-55478Mediumsnipe/snipe-it: Snipe-IT has missing object-level authorization in Kits API CVE-2026-55476Mediumsnipe/snipe-it: Snipe-IT Vulnerable to Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter CVE-2026-55475Mediumsnipe/snipe-it: Snipe-IT's import created_by can be overwritten CVE-2026-55474Highsnipe/snipe-it: Snipe-IT vulnerable to directory traversal in displaySig CVE-2026-55472Mediumsnipe/snipe-it: Snipe-IT's API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation CVE-2026-55469Lowsnipe/snipe-it: Snipe-IT has a path traversal vulnerability via CSV import `image` field CVE-2026-55466Mediumsnipe/snipe-it: Snipe-IT vulnerable to stored XSS via inline-served attachment CVE-2026-55464Mediumsnipe/snipe-it: Snipe-IT vulnerable to stored XSS via Markdown custom field CVE-2026-55462Mediumsnipe/snipe-it: Snipe-IT has an authorization bypass on print inventory page CVE-2026-55461Mediumsnipe/snipe-it: Snipe-IT has an Open Redirect After User Edit CVE-2026-55460Highsnipe/snipe-it: Snipe-IT has an authorization bypass on bulk editing users CVE-2026-55452Mediumsnipe/snipe-it: Snipe-IT has CSV formula injection in Activity Report export CVE-2026-55566Mediumorg.yamcs:yamcs-core: Yamcs has DOM XSS in Extension Routing CVE-2026-55565Criticalorg.yamcs:yamcs-core: Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo