Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

77 advisories

Loading
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not... Moderate Unreviewed
CVE-2026-85976 was published Oct 12, 2026
Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass Moderate
GHSA-cw3j-28qq-x3xh was published for hono (npm) Jul 1, 2026 • withdrawn
Hono missing validation of cookie name on write path in setCookie() Moderate
CVE-2026-56762 was published for hono (npm) Apr 8, 2026
athuljayaram Credited to athuljayaram
Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie() Moderate
GHSA-55cm-p4ww-685g was published for hono (npm) Jun 23, 2026 • withdrawn
Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in... Moderate Unreviewed
CVE-2026-93711 was published Sep 22, 2026
oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass Moderate
CVE-2026-77360 was published for @orpc/server (npm) Sep 17, 2026
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows... Moderate Unreviewed
CVE-2026-91991 was published Sep 15, 2026
Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to... Moderate Unreviewed
CVE-2024-58384 was published Sep 15, 2026
The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to... Moderate Unreviewed
CVE-2026-2811 was published Sep 2, 2026
Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection Moderate
CVE-2026-50630 was published for org.apache.cxf:cxf-rt-rs-security-oauth2 (Maven) Jun 12, 2026
cowboy and gun affected by an HTTP Request/Response Splitting vulnerability Moderate
CVE-2026-43966 was published for cowboy (Erlang) Jun 8, 2026
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to... Moderate Unreviewed
CVE-2026-66753 was published Jul 28, 2026
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote... Moderate Unreviewed
CVE-2026-66746 was published Jul 28, 2026
swift-nio-http2: Missing CR/LF/NUL validation in header values Moderate
CVE-2026-64785 was published for swift-nio-http2 (Swift) Jul 24, 2026
sour-exploit Credited to sour-exploit
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to... Moderate Unreviewed
CVE-2026-63771 was published Jul 20, 2026
guzzlehttp/psr7 has CRLF Injection via URI Host Component Moderate
CVE-2026-49214 was published for guzzlehttp/psr7 (Composer) Jun 11, 2026
edorian Credited to edorian
Secure Headers: CSP directive injection via sandbox, plugin_types, and report_to when given untrusted input Moderate
CVE-2026-54163 was published for secure_headers (RubyGems) Jul 10, 2026
tonghuaroot Credited to tonghuaroot
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization Moderate
CVE-2026-55766 was published for guzzlehttp/psr7 (Composer) Jun 19, 2026
iliaal Credited to iliaal
Kirby: Request header injection in `Http\Remote` Moderate
CVE-2026-50188 was published for getkirby/cms (Composer) Jun 18, 2026
eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields Moderate
CVE-2026-44214 was published for eventsource-encoder (npm) May 8, 2026
transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI... Moderate Unreviewed
CVE-2026-38978 was published Jun 2, 2026
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection Moderate
CVE-2026-47675 was published for hono (npm) Jun 4, 2026
offset Credited to offset and 0xEr3n 0xEr3n 0xEr3n
Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain Moderate
CVE-2026-40175 was published for axios (npm) Apr 10, 2026
raulvdv Credited to raulvdv, SwTan98, Wenxin-Jiang, jasonsaayman, and ylemkimon SwTan98 SwTan98
Wenxin-Jiang Wenxin-Jiang jasonsaayman jasonsaayman ylemkimon ylemkimon
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control... Moderate Unreviewed
CVE-2026-7010 was published May 12, 2026
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest Moderate
CVE-2026-34767 was published for electron (npm) Apr 3, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database