Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

569 advisories

Loading
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation Critical
CVE-2026-94603 was published for github.com/containers/podman (Go) Oct 15, 2026
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication Critical
CVE-2026-77524 was published for github.com/kedacore/keda (Go) Oct 15, 2026
cherez0ff Credited to cherez0ff, the-vibe-dev, everping, zwindler, b0b0haha, and j311yl0v3u the-vibe-dev the-vibe-dev
everping everping zwindler zwindler b0b0haha b0b0haha j311yl0v3u j311yl0v3u
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks Critical
CVE-2026-77459 was published for github.com/argoproj/argo-cd/v2 (Go) Oct 15, 2026
RealFakeAccount Credited to RealFakeAccount, AdamKorcz, 0xshylines, thevilledev, HenriWilliams, cherez0ff, and zwindler AdamKorcz AdamKorcz
0xshylines 0xshylines thevilledev thevilledev HenriWilliams HenriWilliams cherez0ff cherez0ff zwindler zwindler
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service Critical
CVE-2026-102748 was published for github.com/dgraph-io/dgraph/v25 (Go) Oct 15, 2026
0d000721999 Credited to 0d000721999
Vitess vttablet /twopcz reflected XSS Critical
CVE-2026-104252 was published for vitess.io/vitess (Go) Oct 15, 2026
xylove21 Credited to xylove21
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite Critical
CVE-2026-107806 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
mamdouhmahfouz Credited to mamdouhmahfouz
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) Critical
CVE-2026-68582 was published for code.vikunja.io/api (Go) Oct 9, 2026
Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) Critical
GHSA-p4r4-8cxw-pjx7 was published for code.vikunja.io/api (Go) Aug 2, 2026 • withdrawn
Alist has Insecure TLS Config Critical
CVE-2026-25160 was published for github.com/alist-org/alist/v3 (Go) Feb 4, 2026
XlabAITeam Credited to XlabAITeam, pkuGenuine, A7um, keenanwgn, and okatu-loli pkuGenuine pkuGenuine
A7um A7um keenanwgn keenanwgn okatu-loli okatu-loli
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login Critical
CVE-2026-62252 was published for github.com/sipcapture/homer-app (Go) Oct 7, 2026
de3erve-hunter Credited to de3erve-hunter
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) Critical
CVE-2026-62253 was published for github.com/sipcapture/homer-app (Go) Oct 7, 2026
de3erve-hunter Credited to de3erve-hunter
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled Critical
CVE-2026-73802 was published for gitea.com/gitea/runner (Go) Oct 2, 2026
sn0x-sharma Credited to sn0x-sharma
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs Critical
CVE-2026-59707 was published for github.com/mudler/LocalAI (Go) Jul 7, 2026
Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route Critical
GHSA-75xh-mp4f-f2rf was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking Critical
CVE-2026-69085 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 1, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking Critical
GHSA-5w4j-hchp-r332 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 3, 2026 • withdrawn
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag Critical
GHSA-wfqx-gjrf-g28r was published for github.com/crossplane/crossplane (Go) Jun 19, 2026
bugbunny-research Credited to bugbunny-research, tonghuaroot, and adamwg tonghuaroot tonghuaroot
adamwg adamwg
ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass Critical
CVE-2026-61604 was published for github.com/ixofoundation/ixo-blockchain (Go) Sep 24, 2026
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack Critical
CVE-2026-63132 was published for github.com/openbao/openbao (Go) Sep 22, 2026
Canonical ADSys Uses a Less Trusted Source Critical
CVE-2026-12249 was published for github.com/ubuntu/adsys (Go) Jun 22, 2026
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace Critical
CVE-2026-61682 was published for github.com/kcp-dev/kcp (Go) Sep 18, 2026
5ud0er Credited to 5ud0er
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr Critical
CVE-2026-77411 was published for github.com/rabbitmq/amqp091-go (Go) Sep 17, 2026
suchitd Credited to suchitd and MirahImage MirahImage MirahImage
RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow Critical
CVE-2026-77408 was published for github.com/rabbitmq/amqp091-go (Go) Sep 17, 2026
suchitd Credited to suchitd
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser Critical
CVE-2026-77405 was published for github.com/rabbitmq/amqp091-go (Go) Sep 17, 2026
suchitd Credited to suchitd
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends Critical
CVE-2026-71485 was published for github.com/centrifugal/centrifugo (Go) Sep 2, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database