Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55637Highgithub.com/geiserx/genieacs-mcp: genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transportGHSA-VWF3-4XXJ-QG6HHighmcp-contextforge-gateway: mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via…CVE-2026-55419Mediumreachy-mini: reachy_mini Allows Unrestricted Upload of File with Dangerous TypeCVE-2026-55092Highgithub.com/aquasecurity/trivy: Trivy has a path traversal via a crafted vulnerability database or other downloaded artifactsGHSA-PG62-F8G4-4WQHHighphpmyfaq/phpmyfaq: phpMyFAQ privilege escalation: GroupController::updatePermissions lets a GROUP_EDIT admin grant rights they do not holdGHSA-MF8R-WM2W-F8C5Mediumthorsten/phpmyfaq: phpMyFAQ public FAQ APIs expose inactive FAQ contentGHSA-88G4-74F3-63X9Mediumthorsten/phpmyfaq: phpMyFAQ has Potential Authenticated Path Traversal in PDF ExportCVE-2026-55596High@platejs/media: Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScriptCVE-2026-55557Highbrowse-mcp: browse-mcp has an arbitrary file write via unconfined download and state pathsCVE-2026-55585Highqwed: qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`CVE-2026-55553Highurllib: urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakageCVE-2026-55677Highgithub.com/labstack/echo/v5: Echo: Encoded slash (%2F) bypasses route-level protection and exposes static filesCVE-2026-55571Highdjust: djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated…CVE-2026-55640Criticalnextcloud-mcp-server: nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset (…GHSA-8QX3-8GM5-9CJ2Highpickem: pickem vulnerable to terminal escape-sequence injection via unsanitized item textGHSA-8CP3-QXJ6-PX34Highutcp-http: utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI ConversionCVE-2026-12210Mediumutcp-gql: utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket pluginsGHSA-9QHG-99WW-9MQCHighutcp-http: utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the targetCVE-2026-55580Highgithub.com/sonirico/mcp-shell: mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode AllowlistCVE-2026-55581Highgithub.com/sonirico/mcp-shell: mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` ExecutableCVE-2026-55582Highgithub.com/sonirico/mcp-shell: mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo