Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

115 advisories

Loading
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not... Moderate Unreviewed
CVE-2026-85976 was published Oct 12, 2026
An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated... Critical Unreviewed
CVE-2026-105324 was published Oct 7, 2026
Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass Moderate
GHSA-cw3j-28qq-x3xh was published for hono (npm) Jul 1, 2026 • withdrawn
Hono missing validation of cookie name on write path in setCookie() Moderate
CVE-2026-56762 was published for hono (npm) Apr 8, 2026
athuljayaram Credited to athuljayaram
Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie() Moderate
GHSA-55cm-p4ww-685g was published for hono (npm) Jun 23, 2026 • withdrawn
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in... Moderate Unreviewed
CVE-2026-93711 was published Sep 22, 2026
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass Moderate
CVE-2026-77360 was published for @orpc/server (npm) Sep 17, 2026
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows... Moderate Unreviewed
CVE-2026-91991 was published Sep 15, 2026
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to... Moderate Unreviewed
CVE-2024-58384 was published Sep 15, 2026
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to... Moderate Unreviewed
CVE-2026-2811 was published Sep 2, 2026
Applications that build a Content-Disposition header value from untrusted input may be vulnerable... Low Unreviewed
CVE-2026-59314 was published Aug 27, 2026
go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer()... High Unreviewed
CVE-2026-75419 was published Aug 28, 2026
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to... High Unreviewed
CVE-2026-39915 was published Aug 24, 2026
Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection Moderate
CVE-2026-50630 was published for org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) Jun 12, 2026
An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')... Low Unreviewed
CVE-2025-62826 was published Jul 14, 2026
An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')... Low Unreviewed
CVE-2025-62675 was published Jul 14, 2026
FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters... Critical Unreviewed
CVE-2026-67289 was published Aug 1, 2026
cowboy and gun affected by an HTTP Request/Response Splitting vulnerability Moderate
CVE-2026-43966 was published for cowboy (Erlang) Jun 8, 2026
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to... Moderate Unreviewed
CVE-2026-66753 was published Jul 28, 2026
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote... Moderate Unreviewed
CVE-2026-66746 was published Jul 28, 2026
swift-nio-http2: Missing CR/LF/NUL validation in header values Moderate
CVE-2026-64785 was published for swift-nio-http2 (Swift) Jul 24, 2026
sour-exploit Credited to sour-exploit
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to... Moderate Unreviewed
CVE-2026-63771 was published Jul 20, 2026
guzzlehttp/psr7 has CRLF Injection via URI Host Component Moderate
CVE-2026-49214 was published for guzzlehttp/psr7 (Composer) Jun 11, 2026
edorian Credited to edorian
AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass Low
CVE-2026-34520 was published for aiohttp (pip) Apr 1, 2026
vmfunc Credited to vmfunc, oxqnd, and rodrigobnogueira oxqnd oxqnd
rodrigobnogueira rodrigobnogueira
Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input Moderate
CVE-2026-54163 was published for secure_headers (RubyGems) Jul 10, 2026
tonghuaroot Credited to tonghuaroot
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database