Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54256Mediumwinter/wn-backend-module: Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadataCVE-2026-54251Highio.netty.incubator:netty-incubator-codec-ohttp: netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of ServiceCVE-2026-54245Highgithub.com/fleetdm/fleet: Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet databaseCVE-2026-54182Highbackpack/crud: Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)CVE-2026-54181Mediumbackpack/crud: Laravel Backpack CRUD: Stored XSS in the color column — the `@if($column['escaped'])` branches are invertedCVE-2026-54180Highbackpack/crud: Laravel Backpack CRUD: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)CVE-2026-54179Mediumbackpack/crud: Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public diskCVE-2026-54178Highbackpack/crud: Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDiskCVE-2026-54177Mediumbackpack/crud: Laravel Backpack CRUD: HasUploadFields keeps the attacker-supplied file extension — public-disk uploads of `shell.php` reach the webserverCVE-2026-54176Mediumbackpack/crud: Laravel Backpack CRUD: MyAccountController allows changing the login email without a current-password checkCVE-2026-54175Highbackpack/crud: Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignmentCVE-2026-55445Critical@whyour/qinglong: Qinglong has an incomplete fix for CVE-2026-3965: Improper AuthenticationCVE-2026-54168Mediumgithub.com/openshift-pipelines/pipelines-as-code: Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task…CVE-2026-54167Highgithub.com/openshift-pipelines/pipelines-as-code: Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host headerGHSA-22W5-2FXG-VRWXLowgithub.com/opentofu/opentofu: OpenTofu has high CPU usage when using K8S remote state backend or when parsing specifically crafted TLS certificates from untrusted or…CVE-2026-54162Mediumgithub.com/alexandre-daubois/ember: Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUICVE-2026-54156Highnode-opcua: node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSCVE-2026-54155Highnode-opcua: node-opcua missing nonce verification in UserNameIdentityToken authenticationCVE-2026-54150Mediumnext-video: next-video: Unauthenticated arbitrary file read via /api/video request handlerGHSA-H58C-XCCX-75M3Lowgithub.com/coder/coder/v2: Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settingsGHSA-8FXQ-53RX-PH5FLowgithub.com/coder/coder/v2: Coder: Login endpoint user enumeration via timing-defense placeholder in password comparisonGHSA-MC9M-6FM9-PGHCMediumzoo-kcl: Zoo Design Studio: Memory-corruption in memory handling of lib-kclGHSA-JGVR-6X5W-HX5WMediumzoo-kcl: Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-serviceCVE-2026-75140Highorg.jsoup:jsoup: jsoup XmlTreeBuilder vulnerable to memory exhaustion through deeply nested namespace declarationsGHSA-5P3M-VHH6-9236Mediumstigmem-node: stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo