Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

89 advisories

Loading
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware... Moderate Unreviewed
CVE-2026-111934 was published Oct 17, 2026
Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test... Moderate Unreviewed
CVE-2026-111443 was published Oct 16, 2026
Wheels through 4.1.1 derives its default production error-email address from the Host header of... Moderate Unreviewed
CVE-2026-111450 was published Oct 16, 2026
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver... Moderate Unreviewed
CVE-2026-110726 was published Oct 15, 2026
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain... Critical Unreviewed
CVE-2026-93483 was published Oct 15, 2026
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows... Moderate Unreviewed
CVE-2026-108736 was published Oct 11, 2026
PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote... Low Unreviewed
CVE-2026-108555 was published Oct 10, 2026
Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows... Moderate Unreviewed
CVE-2026-108162 was published Oct 10, 2026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use... Low Unreviewed
CVE-2026-78015 was published Oct 9, 2026
Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated... Moderate Unreviewed
CVE-2026-107271 was published Oct 7, 2026
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion Moderate
CVE-2026-102275 was published for PyJWT (pip) Oct 5, 2026
ze3tar Credited to ze3tar
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet Critical
CVE-2026-90711 was published for proxy-addr (npm) Oct 5, 2026
kagebunsher Credited to kagebunsher, UlisesGascon, and kustundag UlisesGascon UlisesGascon
kustundag kustundag
Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID... Low Unreviewed
CVE-2026-105051 was published Oct 3, 2026
simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the... Moderate Unreviewed
CVE-2026-103592 was published Oct 1, 2026
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X... Low Unreviewed
CVE-2026-102630 was published Sep 29, 2026
A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted... Moderate Unreviewed
CVE-2026-101277 was published Sep 29, 2026
vLLM is an inference and serving engine for large language models. In versions from 0.22.1... High Unreviewed
CVE-2026-100653 was published Sep 26, 2026
The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client... Moderate Unreviewed
CVE-2026-80514 was published Sep 25, 2026
In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending... Critical Unreviewed
CVE-2026-97404 was published Sep 24, 2026
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19... Moderate Unreviewed
CVE-2026-92530 was published Sep 24, 2026
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped... Moderate Unreviewed
CVE-2026-84718 was published Sep 23, 2026
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a... Moderate Unreviewed
CVE-2026-87070 was published Sep 23, 2026
Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header Moderate
CVE-2026-62987 was published for github.com/fabiolb/fabio (Go) Sep 22, 2026
thientd Credited to thientd
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace Critical
CVE-2026-61682 was published for github.com/kcp-dev/kcp (Go) Sep 18, 2026
5ud0er Credited to 5ud0er
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path Moderate
CVE-2026-61589 was published for djust (pip) Sep 16, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database