Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55558Mediumaiosmtplib: aiosmtplib: STARTTLS response injectionCVE-2026-54770Mediumwebob: WebOb: Open redirect in Location header normalization via leading C0 control / space charactersCVE-2026-37004Criticallitellm: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointGHSA-MF7Q-R4RV-JV94Highgithub.com/crossplane/crossplane-runtime/v2: Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature…CVE-2026-54732Mediumlibreoffice-convert: libreoffice-convert vulnerable to path traversal / arbitrary file writeCVE-2026-54718Highsymbiote/silverstripe-advancedworkflow: silverstripe-advancedworkflow vulnerable to remote code execution via advanced workflow email templateCVE-2026-42350Lowgithub.com/akuity/kargo: Kargo has Open Redirect in UI OIDC Login Flow via redirectTo Query ParameterCVE-2026-54687Mediumn8n-nodes-sqlite3: n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)CVE-2026-54713Lowcakephp/queue: cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisionsCVE-2026-54721Highsilverstripe/userforms: silverstripe/userforms vulnerable to remote code execution via userforms email subjectCVE-2026-54720Mediumsilverstripe/framework: Silverstripe Framework: Possible XSS attack through media embedCVE-2026-47890Criticalorg.springframework:spring-webflux: Spring Framework Server Sent Event stream corruption while rendering fragmentsCVE-2026-47884Criticalorg.springframework:spring-webmvc: Spring Framework Improper Path Limitation in XsltViewCVE-2026-47892Criticalorg.springframework:spring-webflux: Spring Framework Header Predicate Bypass in WebFlux Functional EndpointsCVE-2026-44701Lowdevcode-it/openstamanager: OpenSTAManager has HTML Injection in modules/utenti/edit.phpGHSA-7W8C-QGXG-M7JXHighlibrenms/librenms: LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy TemplatesCVE-2026-54591Highasyncssh: asyncssh has SCP Path Traversal to Arbitrary File WriteCVE-2026-54590Mediumasyncssh: asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly…CVE-2026-54614Mediumcakephp/debug_kit: cakephp/debug_kit: MailPreview contains unsafe reflectionCVE-2026-54569Criticalsenaite.core: senaite.core Vulnerable to Eval Injection and Missing AuthorizationCVE-2026-54606Highsuneditor: SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe EmbedCVE-2026-54563Highgithub.com/cloudreve/Cloudreve/v4: Cloudreve WebDAV (`/dav`) has Path Traversal / Broken Access Control — scoped DAV credential escapes its configured account rootGHSA-X287-5C68-36WPMediumopenwisp-ipam: OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's…GHSA-93QJ-5Q5V-3C2HCriticalpantheon-agents: Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)CVE-2026-55688Mediumorg.asynchttpclient:async-http-client: AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo