Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-118651Mediumgithub.com/labstack/echo/v5: Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by DefaultGHSA-4MFG-R38W-W8FGHighmcp-sanitizer: mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6GHSA-7W82-6F9J-V9JPHighmcp-sanitizer: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute PathsCVE-2026-58273Highrucio: rucio has an Authorization Bypass on REST API endpoint for signing URLsGHSA-473Q-M89C-GHF8MediumMySqlConnector: MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before…CVE-2026-55458Lowgithub.com/caddyserver/caddy/v2: Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughCVE-2026-116690Highmlflow: MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version sourceCVE-2026-116691Mediummlflow: MLflow CrewAI autologging records LLM provider API keys in logged trace spansCVE-2026-116692Criticalmlflow: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed…CVE-2026-116693Highdd-trace: dd-trace: ReDOS in URL query string obfuscationCVE-2026-116675Hightinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serializationCVE-2026-116684Mediummcp: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverCVE-2026-116694Mediumopentelemetry-propagator-jaeger: OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagationCVE-2026-116685Mediummcp: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesCVE-2026-116686Mediummcp: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasCVE-2026-116687Lowckeditor5: CKEditor: Cross-site scripting (XSS) in the engine packageCVE-2026-116688Highckeditor5: CKEditor: Cross-site scripting (XSS) in the engine packageCVE-2026-116679Mediumgithub.com/m1k1o/neko/server: Neko: Authorization bypass in legacy WebRTC input handlingCVE-2026-116676Highgithub.com/runatlantis/atlantis: Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planCVE-2026-116682Highgithub.com/gtsteffaniak/filebrowser/backend: FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directoryCVE-2026-109829Highundici: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectsCVE-2026-109383Highundici: undici vulnerable to TLS certificate validation bypass via dropped tls options in AgentCVE-2026-87018Highundici: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiationCVE-2026-109932Mediumundici: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG bufferingCVE-2026-87029Mediumundici: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo