Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

732 advisories

Loading
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled High
CVE-2026-102675 was published for electron (npm) Sep 29, 2026
manus-use Credited to manus-use
Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR... High Unreviewed
CVE-2026-100830 was published Sep 29, 2026
Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in... Moderate Unreviewed
CVE-2026-100821 was published Sep 29, 2026
Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox... High Unreviewed
CVE-2026-100816 was published Sep 29, 2026
Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR... High Unreviewed
CVE-2026-100809 was published Sep 29, 2026
Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox... High Unreviewed
CVE-2026-100803 was published Sep 29, 2026
An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker... Moderate Unreviewed
CVE-2026-18825 was published Sep 28, 2026
SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in... High Unreviewed
CVE-2026-100642 was published Sep 26, 2026
SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8... High Unreviewed
CVE-2026-100646 was published Sep 26, 2026
OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In... High Unreviewed
CVE-2026-100598 was published Sep 26, 2026
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint) High
CVE-2026-59723 was published for cline (npm) Sep 24, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution Critical
CVE-2026-61742 was published for @bytebase/dbhub (npm) Sep 24, 2026
junbyjun1238 Credited to junbyjun1238 and avishaigonen-pluto avishaigonen-pluto avishaigonen-pluto
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to,... High Unreviewed
CVE-2026-85682 was published Sep 24, 2026
Fabasoft Folio Client before 2026, a locally installed component that communicates with the... Moderate Unreviewed
CVE-2026-97155 was published Sep 24, 2026
A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin... Unknown Unreviewed
CVE-2026-94243 was published Sep 23, 2026
Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local... Moderate Unreviewed
CVE-2026-94111 was published Sep 20, 2026
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools Moderate
CVE-2026-77339 was published for github.com/f1bonacc1/process-compose (Go) Sep 18, 2026
avishaigonen-pluto Credited to avishaigonen-pluto and yotampe-pluto yotampe-pluto yotampe-pluto
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match Low
CVE-2026-72702 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall... Low Unreviewed
CVE-2026-12284 was published Sep 17, 2026
Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not... Moderate Unreviewed
CVE-2026-75025 was published Sep 16, 2026
A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof,... Moderate Unreviewed
CVE-2026-77119 was published Sep 16, 2026
A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the... Low Unreviewed
CVE-2026-92359 was published Sep 16, 2026
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate... High Unreviewed
CVE-2026-86466 was published Sep 16, 2026
Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156... Moderate Unreviewed
CVE-2026-92068 was published Sep 15, 2026
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 156. Critical Unreviewed
CVE-2026-92034 was published Sep 15, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database