Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-53964Highdocument-merge-service: Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)CVE-2026-53957High@contentful/mcp-server: Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to…CVE-2026-53951Highcopier: Copier has a trust-prefix bypass via path traversal that runs tasks unpromptedCVE-2026-53941Mediumgithub.com/inspektor-gadget/inspektor-gadget: Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoSGHSA-QWGH-2VCV-G2F7Mediumblock_buffer: block_buffer: panic corrupts inline buffer positionGHSA-RR55-JP92-8WP2Highclaude-faf-mcp: claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF toolsGHSA-J4R7-8PH4-43G3Highfaf-mcp: faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF toolsGHSA-CC2G-GQ8C-R332Highgrok-faf-mcp: grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF toolsCVE-2026-55236Mediumlanggraph-api: langgraph-api: Incomplete assistant authorization in LangGraph Server run creationCVE-2026-55235Mediumlanggraph-api: langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authenticationCVE-2026-73974Mediumlinuxfabrik-lib: linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)CVE-2026-17106Highgithub.com/moby/go-archive: moby/go-archive: Crafted tar archive can write outside the extraction directoryGHSA-7GWW-X7FH-JF9JHighlibrenms/librenms: LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig pageGHSA-7CJ5-V4PP-V632Mediumlibrenms/librenms: LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated usersGHSA-JF24-8G2H-2WG7Mediumlibrenms/librenms: LibreNMS Vulnerable to Remote Code Execution via AboutControllerCVE-2026-71417Highlemur: Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking itCVE-2026-71322Mediumlemur: Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = FalseCVE-2026-71317Mediumlemur: Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authorityCVE-2026-71308Highlemur: Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificatesCVE-2026-71307Highlemur: Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the…CVE-2026-71303Highlemur: Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP,…CVE-2026-70667Mediumlemur: Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for…CVE-2026-70666Highlemur: Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLsCVE-2026-65959Mediumvitess.io/vitess: Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL dataCVE-2026-62988Criticalfroxlor/froxlor: Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo