Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55546Criticalqwed-mcp: qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression InputCVE-2026-55536CriticalPraisonAI: PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 /…CVE-2026-55532HighPraisonAI: PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP…CVE-2026-55533HighPraisonAI: PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secretCVE-2026-55539HighPraisonAI: PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft,…CVE-2026-55527Highpraisonaiagents: praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable…CVE-2026-55541HighPraisonAI: PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforcedCVE-2026-55535MediumPraisonAI: PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validationCVE-2026-55537HighPraisonAI: PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114CVE-2026-55538HighPraisonAI: PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST…CVE-2026-55540HighPraisonAI: PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinksCVE-2026-55530Mediumpraisonaiagents: praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation toolCVE-2026-55524Highpraisonaiagents: praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)CVE-2026-55534HighPraisonAI: PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent executionCVE-2026-55526Highpraisonaiagents: praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)CVE-2026-55531MediumPraisonAI: PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)CVE-2026-55528Highpraisonaiagents: praisonaiagents: AgentServer declares auth_token but never enforces it on any routeCVE-2026-55529MediumPraisonAI: PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local…CVE-2026-55523Highpraisonaiagents: praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targetsCVE-2026-55522Highpraisonaiagents: PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe codeCVE-2026-55525Highpraisonaiagents: praisonaiagents web_crawl vulnerable to SSRF via redirect-followingGHSA-FX4F-MHW4-QM7JMediumvibeio-http: vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengthsGHSA-W8J7-39HP-8X59Mediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve's remote download file paths can escape the selected destination directoryGHSA-VX2M-JPXR-XV7WMediumgithub.com/cloudreve/Cloudreve/v4: Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hintCVE-2026-55477Highgithub.com/mhsanaei/3x-ui/v3: 3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo