Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

58 advisories

Loading
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not... Moderate Unreviewed
CVE-2026-78022 was published Oct 9, 2026
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a... Moderate Unreviewed
CVE-2026-101998 was published Oct 8, 2026
Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE (RFC 7672) to... High Unreviewed
CVE-2026-107584 was published Oct 8, 2026
P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank... Critical Unreviewed
CVE-2026-103510 was published Oct 5, 2026
heym before 0.0.105 does not act on the result of the credential authorization lookup in the... Moderate Unreviewed
CVE-2026-100860 was published Sep 27, 2026
TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils... Moderate Unreviewed
CVE-2026-100304 was published Sep 25, 2026
@bytebase/dbhub's read-only mode does not prevent database writes High
CVE-2026-61788 was published for @bytebase/dbhub (npm) Sep 24, 2026
ixNyf Credited to ixNyf
BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with... Moderate Unreviewed
CVE-2026-88831 was published Sep 23, 2026
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for High
CVE-2026-77560 was published for github.com/tinyauthapp/tinyauth (Go) Sep 22, 2026
5ud0er Credited to 5ud0er
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not... High Unreviewed
CVE-2026-92591 was published Sep 17, 2026
djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data High
CVE-2026-61595 was published for djust (pip) Sep 16, 2026
Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls... Critical Unreviewed
CVE-2026-77866 was published Sep 15, 2026
APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in... Moderate Unreviewed
CVE-2026-86120 was published Sep 5, 2026
Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a... High Unreviewed
CVE-2026-18329 was published Sep 2, 2026
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass... Moderate Unreviewed
CVE-2026-82018 was published Aug 29, 2026
AIIR verification and policy gates could report success without enforcing the control (fail-open) Moderate
GHSA-73p9-6hrp-8qhr was published for aiir (pip) Aug 28, 2026
Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to... High Unreviewed
CVE-2026-69306 was published Aug 11, 2026
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition... High Unreviewed
CVE-2026-44094 was published Jul 30, 2026
nono-cli'scregistry pack verification can fail open when provenance metadata is absent Moderate
GHSA-hc4m-q9jh-xw4j was published for nono-cli (Rust) Jul 28, 2026
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) Critical
CVE-2026-73421 was published for next-auth (npm) Jul 23, 2026
marc-zollingkoffer-syzygy Credited to marc-zollingkoffer-syzygy
JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`) Low
GHSA-whvh-wf3x-g77j was published for jupyterlab (pip) Jul 22, 2026
de3erve-hunter Credited to de3erve-hunter, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms High
CVE-2026-54291 was published for org.postgresql:postgresql (Maven) Jul 21, 2026
KEIJOT Credited to KEIJOT
Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the... Low Unreviewed
CVE-2026-62235 was published Jul 17, 2026
OpenClaw: Mattermost handlers could fall open when channel type was missing Moderate
CVE-2026-53837 was published for openclaw (npm) Jul 2, 2026
zsxsoft Credited to zsxsoft, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms High
CVE-2026-53712 was published for com.ongres.scram:scram-client (Maven) Jul 1, 2026
KEIJOT Credited to KEIJOT and jorsol jorsol jorsol
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database