Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55410Medium@nocobase/plugin-backups: NocoBase backup restore schema name allows command injectionCVE-2026-55253Highlanggraph-checkpoint-mongodb: LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposureCVE-2026-54061Criticalgithub.com/dgraph-io/dgraph/v25: Dgraph Alpha group stores can be replaced via unauthenticated external snapshot importCVE-2026-55244Mediumasteval: asteval has a Sandbox Escape via BaseException SubclassesGHSA-9W56-46F6-3QHXMediumasteval: asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval InterpreterCVE-2026-55149Highgithub.com/vouch/vouch-proxy: vouch-proxy has an Unbounded Multipart Cookie Allocation DoSCVE-2026-45404Mediumgo.opentelemetry.io/otel/bridge/opentracing: OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent accessCVE-2026-32637Mediumgithub.com/vmware-tanzu/velero: Velero vulnerable to file path traversal when extracting from backup's tarballCVE-2026-63123Medium@tinacms/cli: Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media rootCVE-2026-59992Mediumnext-tinacms-s3: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)CVE-2026-63188High@logto/tunnel: logto-tunnel serves files outside `--experience-path` via path traversalCVE-2026-61712Lowgithub.com/moby/buildkit: BuildKit has a possible runtime DoS via unbounded group parsingCVE-2026-61711Mediumgithub.com/moby/buildkit: BuildKit: Custom frontend could bypass Seccomp/AppArmorGHSA-HJWH-XVFW-QRWJMediummcp-searxng: SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error ResponsesCVE-2026-62673Highgetgrav/grav: Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystemsCVE-2026-61807Mediumsnipe/snipe-it: Snipe-IT: Stored DOM XSS via table selected-count IDsCVE-2026-55703Mediumsnipe/snipe-it: Snipe-IT: Maintenance Record Disclosure via Missing Authorization on GETCVE-2026-55694Highsnipe/snipe-it: Snipe-IT: Chained Information Disclosure and IDOR Leads to Full EULA File TakeoverCVE-2026-55643Highsnipe/snipe-it: Snipe-IT: Tenant Isolation Bypass in FMCS Floater ModeCVE-2024-45747Highorg.geoserver:gs-main: GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templatesCVE-2026-54689Mediummcp-searxng: SearXNG MCP Server: Additional hardened-mode SSRF bypassesCVE-2026-54688Mediummcp-searxng: SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)GHSA-P77J-G7H5-R2VWHighgeolens: GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)CVE-2026-53966Highorg.xwiki.platform:xwiki-platform-livedata-livetable: XWiki Platform Live Data Live Table Connector has privilege escalation from edit to script right through Live Data editingCVE-2026-53965Highmcp/sdk: MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo