Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55559Criticalorg.yamcs:yamcs-core: Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)CVE-2026-55552Highorg.yamcs:yamcs-core: Yamcs has Unauthenticated Directory TraversalCVE-2026-55549Mediumorg.yamcs:yamcs-core: Yamcs has Reflected XSS in the URL of the Authorize EndpointCVE-2026-55548Mediumorg.yamcs:yamcs-core: Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packetsCVE-2026-55547Mediumorg.yamcs:yamcs-core: Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security…CVE-2026-55545Mediumorg.yamcs:yamcs-core: Yamcs's WebSocket subscription handlers omit the privilege checks their REST siblings enforceCVE-2026-55521Highorg.yamcs:yamcs-core: Yamcs Core API has Multiple Missing Function Level Access Control vulnerabilitiesCVE-2026-55511Criticalorg.yamcs:yamcs-core: Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql`CVE-2026-55068Criticalgithub.com/free5gc/free5gc: free5GC NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpointsCVE-2026-55067Mediumcode.vikunja.io/api: Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentCVE-2026-55066Highcode.vikunja.io/api: Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idCVE-2026-55065Highcode.vikunja.io/api: Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled KeyCVE-2026-55064Mediumcode.vikunja.io/api: Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0CVE-2026-54766Mediumcode.vikunja.io/api: Vikunja has a project duplication bypasses write-permission check on the target parent projectCVE-2026-54788Highdatadog-opentelemetry: datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoSCVE-2026-55834Mediumgithub.com/pocket-id/pocket-id/backend: Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=noneCVE-2026-55569Mediumgithub.com/aquaproj/aqua/v2: Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directoryCVE-2026-54755Criticalgithub.com/klever-io/klever-go: Klever: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)CVE-2026-54754Criticalgithub.com/klever-io/klever-go: Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)CVE-2026-54757Highcompliance-trestle: Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted DataCVE-2026-55108Highgithub.com/oam-dev/kubevela: KubeVela Terraform remote loader DoS via unbounded file readGHSA-2VH6-HW4J-32WWMediumgix-packetline: gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS)CVE-2026-54746Mediumgithub.com/hatchet-dev/hatchet: Hatchet allows cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeCVE-2026-57584Highphalcon/cphalcon: Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoSCVE-2026-54736Highphalcon/cphalcon: Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo