Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

50 advisories

Loading
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) Moderate
CVE-2026-83557 was published for com.fasterxml.jackson.core:jackson-databind (Maven) Sep 28, 2026
prvazsahnazarov Credited to prvazsahnazarov
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets Moderate
CVE-2026-55223 was published for com.mchange:c3p0 (Maven) Jul 23, 2026
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution Moderate
CVE-2026-53914 was published for org.jetbrains.kotlin:kotlin-gradle-plugin (Maven) Jun 26, 2026
marcelstoer Credited to marcelstoer and Lueton Lueton Lueton
Jenkins LDAP Plugin deserializes data from LDAP referrals without validation Moderate
CVE-2026-48917 was published for org.jenkins-ci.plugins:ldap (Maven) May 27, 2026
Jenkins Active Directory Plugin deserializes data from LDAP referrals without validation Moderate
CVE-2026-48919 was published for org.jenkins-ci.plugins:active-directory (Maven) May 27, 2026
Jenkins Matrix Authorization Strategy Plugin: Unsafe deserialization allows invocation of parameterless constructors Moderate
CVE-2026-42521 was published for org.jenkins-ci.plugins:matrix-auth (Maven) Apr 29, 2026
Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data Moderate
CVE-2026-27172 was published for org.apache.camel:camel-consul (Maven) Apr 27, 2026
Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability Moderate
CVE-2025-62233 was published for org.apache.dolphinscheduler:dolphinscheduler (Maven) Apr 24, 2026
Bio-Formats performs unsafe Java deserialization of attacker-controlled memoization cache files (.bfmemo) during image processing Moderate
CVE-2026-22187 was published for ome:pom-bio-formats (Maven) Jan 7, 2026
Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization Moderate
CVE-2025-13467 was published for org.keycloak:keycloak-ldap-federation (Maven) Dec 19, 2025
eminaktas Credited to eminaktas
Duplicate Advisory: Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization Moderate
GHSA-93vm-mqpw-8wh3 was published for org.keycloak:keycloak-ldap-federation (Maven) Nov 25, 2025 • withdrawn
Apache Fory Deserialization of Untrusted Data vulnerability Moderate
CVE-2025-59328 was published for org.apache.fory:fory-core (Maven) Sep 15, 2025
Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data Moderate
CVE-2025-58782 was published for org.apache.jackrabbit:jackrabbit-core (Maven) Sep 8, 2025
akka-cluster-metrics uses Java serialization for cluster metrics Moderate
CVE-2025-53393 was published for com.typesafe.akka:akka-cluster-metrics_2.13 (Maven) Jun 29, 2025
Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass Moderate
CVE-2025-27526 was published for org.apache.inlong:manager-pojo (Maven) May 28, 2025
Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read Moderate
CVE-2025-27528 was published for org.apache.inlong:manager-pojo (Maven) May 28, 2025
aizuda snail-job Vulnerable to Deserialization via `nodeExpression` Argument Moderate
CVE-2025-2622 was published for com.aizuda:snail-job (Maven) Mar 22, 2025
Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. Moderate
CVE-2024-45772 was published for org.apache.lucene:lucene-replicator (Maven) Sep 30, 2024
streichsbaer Credited to streichsbaer
Elasticsearch-hadoop Unsafe Deserialization Moderate
CVE-2023-46674 was published for org.elasticsearch:elasticsearch-hadoop (Maven) Dec 5, 2023
Drools Core Deserialization of Untrusted Data vulnerability Moderate
CVE-2022-1415 was published for org.drools:drools-core (Maven) Sep 11, 2023
Apache Johnzon Deserialization of Untrusted Data vulnerability Moderate
CVE-2023-33008 was published for org.apache.johnzon:johnzon-mapper (Maven) Jul 7, 2023
Whaleal IceFrog is vulnerable to deserialization Moderate
CVE-2023-3308 was published for com.whaleal.icefrog:icefrog-all (Maven) Jun 18, 2023
Apache NiFi vulnerable to Deserialization of Untrusted Data Moderate
CVE-2023-34212 was published for org.apache.nifi:nifi-jms-processors (Maven) Jun 12, 2023
exceptionfactory Credited to exceptionfactory
Nuxeo vulnerable to Reflected Cross-Site Scripting leading to Remote Code Execution Moderate
CVE-2021-32828 was published for org.nuxeo.ecm.platform:nuxeo-platform-oauth (Maven) Jan 6, 2023
Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data Moderate
CVE-2022-37023 was published for org.apache.geode:geode-core (Maven) Sep 1, 2022
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database