Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-54786Lowwasmtime-wasi: Wasmtime has a leak in WASIp1 `fd_renumber` implementation CVE-2026-54511High@logtape/syslog: @logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys CVE-2026-54550Highorg.codehaus.izpack:izpack-installer: IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries CVE-2026-54523Criticalgithub.com/kyverno/kyverno: Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any…CVE-2026-54548Lowkas: kas Persistently Disables SSH Host Key Checking CVE-2026-54553Mediumstarlette-admin: Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS CVE-2026-54556Highorg.http4s:http4s-ember-core_2.12: http4s has HTTP/2 Denial of Service with Ember Backend CVE-2026-54356High@budibase/server: Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`CVE-2026-65637Criticalorg.apache.tomcat:tomcat-coyote: Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905Criticalorg.apache.tomcat:tomcat: Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability CVE-2026-65182Criticalorg.apache.tomcat:tomcat: Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability CVE-2026-68525Criticalorg.apache.tomcat:tomcat: Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability CVE-2026-54338Mediumjupyterhub: JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login CVE-2026-55099Highicalendar: icalendar has Algorithmic Complexity in Equality CVE-2026-45019Highchainlit: Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access CVE-2026-45018Criticalchainlit: Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution CVE-2026-55605Medium@arikusi/deepseek-mcp-server: @arikusi/deepseek-mcp-server: Missing Authentication on Self-Hosted HTTP MCP Endpoint CVE-2026-55604High@arikusi/deepseek-mcp-server: @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key CVE-2026-55609Highconsciousness-explorer: consciousness-explorer / sublinear-time-solver MCP export_state has an arbitrary file write CVE-2026-55629Highwhistle: Whistle vulnerable to path traversal CVE-2026-55620Higheml_parser: eml_parser vulnerable to DoS via deeply nested parens in Received headers CVE-2026-55619Mediumeml_parser: eml_parser has parser DoS via deeply nested parentheses in e-mail headers CVE-2026-55618Mediumeml_parser: eml_parser has a URL extraction bypass via HTML entities in URLs CVE-2026-55663Mediummediasoup: mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.