Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

147 advisories

Loading
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to... High Unreviewed
CVE-2026-110857 was published Oct 15, 2026
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker... High Unreviewed
CVE-2026-97801 was published Oct 13, 2026
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate... High Unreviewed
CVE-2026-96044 was published Oct 13, 2026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... Low Unreviewed
CVE-2026-78016 was published Oct 9, 2026
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array High
CVE-2026-107723 was published for fast-jwt (npm) Oct 8, 2026
rtvkiz Credited to rtvkiz
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats High
CVE-2026-61439 was published for PraisonAI (pip) Oct 7, 2026
chakrapani150 Credited to chakrapani150
SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ... Moderate Unreviewed
CVE-2026-94570 was published Sep 22, 2026
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking... Low Unreviewed
CVE-2026-75588 was published Sep 17, 2026
A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776... Moderate Unreviewed
CVE-2026-89207 was published Sep 16, 2026
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Moderate
CVE-2026-87012 was published for open-webui (pip) Sep 10, 2026
DshtAnger Credited to DshtAnger and Classic298 Classic298 Classic298
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non... High Unreviewed
CVE-2026-86287 was published Sep 7, 2026
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar... Moderate Unreviewed
CVE-2026-80051 was published Aug 25, 2026
An ACAP configuration file lacks input validation, which could potentially lead to privilege... Moderate Unreviewed
CVE-2026-5304 was published Aug 11, 2026
Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated... High Unreviewed
CVE-2026-18830 was published Aug 4, 2026
In geniezone, there is a possible escalation of privilege due to a missing permission check. This... Moderate Unreviewed
CVE-2026-20498 was published Aug 3, 2026
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM... High Unreviewed
CVE-2026-4773 was published Jul 22, 2026
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability High
CVE-2026-50524 was published for Microsoft.NetCore.App.Runtime.linux-arm (NuGet) Jul 20, 2026
YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read Moderate
CVE-2026-52763 was published for yeswiki/yeswiki (Composer) Jul 9, 2026
CosmicCrusader23 Credited to CosmicCrusader23
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions High
CVE-2026-2092 was published for org.keycloak:keycloak-services (Maven) Jul 2, 2026
1seal Credited to 1seal
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels Moderate
CVE-2026-54235 was published for vllm (pip) Jun 17, 2026
brodmart Credited to brodmart and jperezdealgaba jperezdealgaba jperezdealgaba
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and... High Unreviewed
CVE-2026-10825 was published Jun 16, 2026
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff... High Unreviewed
CVE-2026-9753 was published Jun 10, 2026
When OIDC authentication is enabled in configuration, clients may set specific values in the ... High Unreviewed
CVE-2026-9742 was published Jun 10, 2026
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to... Moderate Unreviewed
CVE-2024-6858 was published Jun 5, 2026
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection Moderate
CVE-2026-47675 was published for hono (npm) Jun 4, 2026
offset Credited to offset and 0xEr3n 0xEr3n 0xEr3n
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database