Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-77413Criticaljsonata: JSONata: Arbitrary Code Execution via crafted JSONata expressionsCVE-2026-77354Highgithub.com/getkin/kin-openapi: kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decodingCVE-2026-61539Criticalxinference: Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsingCVE-2026-59989Criticalphalcon/cphalcon: Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)CVE-2026-76905Highgithub.com/getkin/kin-openapi: kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoSCVE-2026-64679Highgithub.com/runatlantis/atlantis: Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/CreationCVE-2026-63421High@keystone-6/core: Keystone vulnerable to `graphql.maxTake` bypass with negative `take`CVE-2026-61824Highdefuddle: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractorsCVE-2026-76904Criticalorg.geotools.jdbc:gt-jdbc-postgis: GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layersGHSA-8HGV-XC77-JMCRMediumgetgrav/grav: Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to…CVE-2026-63466Mediumunleash-server: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted usernameCVE-2026-63004Mediumunleash-server: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata…CVE-2026-63462Highunleash-server: Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatterCVE-2026-72818Highnltk: NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtrackingCVE-2026-67448Mediumgithub.com/axllent/mailpit: Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)CVE-2026-67447Mediumgithub.com/axllent/mailpit: Mailpit: SMTP DATA line reader buffers over-limit input before size enforcementCVE-2026-55451Mediumgettext-converter: gettext-converter: Prototype pollution in js2i18next() via crafted translation keysGHSA-JM5P-837G-RV8GMediumwagtail: Wagtail: Improper restriction handling on Page translation API endpointGHSA-X5CX-W6P2-MXF2Mediumwagtail: Wagtail: Improper permission handling when copying snippetsGHSA-C2XX-CJMH-9Q8FMediumwagtail: Wagtail: Improper restriction handling on descendant collections in Documents and Images APIGHSA-92HV-J533-69WCLowwagtail: Wagtail: Identification of documents by SHA1 hashGHSA-HQ84-X37P-J6Q5Mediumwinter/wn-backend-module: Winter: Reflected XSS through the search query parameter in the backend Table widgetGHSA-P2CH-C2C3-4XM5Mediumwinter/wn-backend-module: Winter: CSRF through AJAX handler names reachable as backend page actionsGHSA-5CWR-5JXG-PCF6Mediumwinter/wn-backend-module: Winter: Stored XSS through cached Brand Settings and Editor Settings custom stylesGHSA-FM29-4MQ3-PHG6Highwinter/wn-backend-module: Winter: ImportExportController AJAX handlers bypass granular import/export permission gate

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo