Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-W67G-5RQW-F597Mediumgithub.com/gorilla/websocket: Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask KeyGHSA-4PH6-MJV7-3FQ6Lowgithub.com/tinfoil-factory/netfoil: netfoil vulnerable to improper handling of untrusted DoH response dataCVE-2026-54625Mediumdjango-cms: django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)CVE-2026-54623Highdjango-cms: django CMS: Plugin move endpoint allows cyclic reparenting (DoS)GHSA-3GJW-F78C-VVPWMediumtokio-postgres: tokio-postgres: Panic on a `DataRow` with fewer fields than columns allows denial of serviceGHSA-RGQC-3X5P-6GWGMediumpostgres-protocol: postgres-protocol: Panic decoding a malformed `hstore` value allows denial of serviceGHSA-5X78-73V4-XG6WHighpostgres-protocol: postgres-protocol: Unbounded SCRAM iteration count allows a malicious server to cause CPU-exhaustion denial of serviceCVE-2026-54050Mediumorg.sakaiproject.profile2:profile2-api: Sakai Profile Image Deletion has an IDORCVE-2026-54049Highorg.sakaiproject.conversations:sakai-conversations-impl: Sakai Conversations has a Stored XSS IssueCVE-2026-53710Criticalmcp-contextforge-gateway: mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_serverCVE-2026-78329Criticalorg.apache.camel:camel-undertow: Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow…CVE-2026-59230Mediumorg.apache.camel:camel-mail: Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when…CVE-2026-63621Mediumorg.apache.camel:camel-knative: Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any…CVE-2026-60093Mediumorg.apache.camel:camel-azure-storage-datalake: Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without…CVE-2026-71300Criticalorg.apache.camel:camel-atmosphere-websocket: Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers…CVE-2026-66908Highorg.apache.camel:camel-platform-http-main: Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims…CVE-2026-66907Highorg.apache.camel:camel-google-storage: Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining…CVE-2026-66906Criticalorg.apache.camel:camel-azure-storage-blob: Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without…CVE-2026-76845Mediumadm-zip: adm-zip extraction follows destination symlinks, allowing arbitrary file overwriteCVE-2026-71514Lownltk: NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosureCVE-2026-71513Highnltk: NLTK AllowlistUnpickler dotted-name validation bypass allows remote code executionCVE-2026-77415Criticaljsonata: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressionsCVE-2026-77414Criticaljsonata: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressionsCVE-2026-68508Highhydra-core: Hydra: hydra.utils.instantiate with untrusted config can lead to code executionCVE-2026-63135Highyourls/yourls: YOURLS has stored XSS in referrer statistics chart via crafted Referer header

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo