Kodem's Vulnerability Database

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-55593Mediumfroxlor/froxlor: Froxlor has CSRF Vulnerability in AJAX Endpoint — Missing Cross-Site Request Forgery ProtectionCVE-2026-54543Mediumfroxlor/froxlor: Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fieldsCVE-2026-54348Highfroxlor/froxlor: Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database ExfiltrationCVE-2026-54347Highfroxlor/froxlor: Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account TakeoverCVE-2026-54723Mediumdevpi-server: devpi-server may leak database contentsCVE-2026-55224Highmineadmin/mineadmin: MineAdmin Vulnerable to Path Traversal via Unsanitized identifier in Plugin Install/UninstallGHSA-WG9G-W2J2-8PGRHighmonai: MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy filesGHSA-RGHG-Q7WP-9767HighMONAI: MONAI vulnerable to OS command injectionGHSA-QXQ5-QHX6-94QWHighmonai: Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patchGHSA-VJF8-9FX6-MV6XMediumtriton-vm: Triton VM Soundness Vulnerability due to Missing ConstraintCVE-2026-54133Criticalmtdowling/jmespath.php: jmespath.php has CompilerRuntime code injection via unescaped function namesCVE-2026-55211Criticalsurfio: surfio has an out-of-bounds readCVE-2026-55209Criticalresdata: resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds ReadCVE-2026-55107Criticalkobako: kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)GHSA-C7HR-448W-65PXHighmeshcentral: MeshCentral has unsanitized data fieldsCVE-2026-18963Criticalorg.keycloak:keycloak-services: Keycloak: Unauthenticated account takeover via reset-credentials flow bypassCVE-2026-68922Mediummobsf: MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP UploadsCVE-2026-68923Mediummobsf: MobSF's CSRF checks not enforced after Django migrationCVE-2026-68927Lowmobsf: MobSF has SSRF port restriction bypass in assetlinks_checkCVE-2026-68924Mediummobsf: MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK ExtractionCVE-2026-63640Mediummagicmirror: MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variablesCVE-2026-55178High@geolens/sdk: GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile…CVE-2026-55182Highlibrenms/librenms: LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation moduleCVE-2026-63643Mediummagicmirror: MagicMirror: ssrf calendar .js

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo