Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-MPMW-F6H6-3G26Mediumwinter/wn-backend-module: Winter: My Account preview exposes another backend user's profile by record IDGHSA-7MPF-4465-7FC2Lowwinter/wn-backend-module: Winter: Stored XSS through Backend List widget image columnsGHSA-RXHG-VCWW-2MPWLowgithub.com/fleetdm/fleet/v4: Fleet: ORDER BY column injection on activity list endpointsGHSA-Q9C5-PP7M-FM2GMediumgithub.com/fleetdm/fleet/v4: Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLsGHSA-8CFW-PCWH-V63WHighwinter/wn-system-module: Winter: Authenticated Twig sandbox escape in CMS SecurityPolicy (bypass of CVE-2024-54149)GHSA-2223-F22X-24CQMediumwinter/wn-system-module: Winter: Local File Inclusion through =include directives in JavaScript asset compilationCVE-2026-63202Highio.netty.incubator:netty-incubator-codec-bhttp: netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decodingCVE-2026-63179Mediumwinter/wn-backend-module: Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assetsCVE-2026-61827Highio.netty.incubator:netty-incubator-codec-bhttp: netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fieldsCVE-2026-63124Highio.netty.incubator:netty-incubator-codec-bhttp: netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundaryCVE-2026-61799Mediumio.netty.incubator:netty-incubator-codec-bhttp: netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crashCVE-2026-61798Highio.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl: netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messagesCVE-2026-61663Mediumdjango-cms: django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staffCVE-2026-63003Mediumdjango-cms: django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)CVE-2026-75526Mediumdjango-cms: django CMS: Stored XSS in edit-mode plugin exception renderingCVE-2026-57570Mediumbackpack/crud: Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelationCVE-2026-55468Mediumwagtail: Wagtail: Improper restriction handling on Pages admin APIGHSA-GHVF-QF6H-G8X5High@nocobase/server: NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code executionCVE-2026-54624Mediumdjango-cms: django CMS: Structure endpoint bypasses page-view permissionCVE-2026-54622Mediumdjango-cms: django CMS: Clipboard copy IDOR discloses unauthorized plugin contentCVE-2026-54263Highwagtail: Wagtail: Reflected XSS in dynamic image URL generator viewCVE-2026-54262Mediumwagtail: Wagtail: Pages translations can be created without page permissions when using simple_translationCVE-2026-54261Mediumwagtail: Wagtail: Improper permission handling in image previewCVE-2026-54260Mediumwagtail: Wagtail: Denial of service via unbounded filter specs in the image previewCVE-2026-54259Mediumwagtail: Wagtail: Improper restriction handling on Documents and Images chosen endpoints

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo