Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,183
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

36,846 advisories

Loading
Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability High
CVE-2026-102870 was published for Microsoft.AspNetCore.Components.WebAssembly.Server (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability High
CVE-2026-96960 was published for System.Security.Cryptography.Xml (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability High
CVE-2026-96233 was published for Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability Moderate
GHSA-86xp-94pg-8r6r was published for Microsoft.AspNetCore.SignalR.Protocols.MessagePack (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability Moderate
CVE-2026-70162 was published for System.Security.Cryptography.Pkcs (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability High
CVE-2026-96958 was published for System.Security.Cryptography.Xml (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability High
CVE-2026-84008 was published for System.Security.Cryptography.Pkcs (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability High
CVE-2026-58280 was published for Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability Moderate
CVE-2026-70194 was published for Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability High
CVE-2026-70183 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability Moderate
CVE-2026-70196 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability Critical
CVE-2026-105016 was published for Microsoft.Native.Quic.MsQuic.Schannel (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability High
CVE-2026-70181 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability High
CVE-2026-70175 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability High
CVE-2026-70159 was published for Microsoft.AspNetCore.SignalR.Common (NuGet) Oct 13, 2026
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted High
GHSA-m687-p538-r5hp was published for code.vikunja.io/api (Go) Oct 9, 2026
arthurscchan Credited to arthurscchan and AdamKorcz AdamKorcz AdamKorcz
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check Moderate
GHSA-fmmf-xq98-g327 was published for code.vikunja.io/api (Go) Oct 9, 2026
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) Moderate
GHSA-pjr3-86v4-5p7w was published for code.vikunja.io/api (Go) Oct 9, 2026
Viv3kGupt4 Credited to Viv3kGupt4
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed Moderate
GHSA-hjx8-qv73-f7cm was published for code.vikunja.io/api (Go) Oct 9, 2026
euriconicacio Credited to euriconicacio and Tan-JunWei Tan-JunWei Tan-JunWei
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants Moderate
GHSA-fprf-r6rv-xg99 was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes Moderate
GHSA-4hv6-xc92-j86g was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage High
CVE-2026-107805 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
lujiefsi Credited to lujiefsi
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout Moderate
CVE-2026-107804 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
lujiefsi Credited to lujiefsi
Tina: Code injection via unescaped Git branch name in generated client source High
CVE-2026-108259 was published for @tinacms/cli (npm) Oct 9, 2026
canhieu Credited to canhieu
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment Critical
CVE-2026-108261 was published for @tinacms/app (npm) Oct 9, 2026
sondt99 Credited to sondt99
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database