Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

732 advisories

Loading
DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the... Moderate Unreviewed
CVE-2026-91201 was published Sep 15, 2026
Description Three separate mechanisms allowed a web page on an unrelated origin to read... High Unreviewed
CVE-2026-82438 was published Sep 14, 2026
An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280,... Moderate Unreviewed
CVE-2026-23792 was published Sep 14, 2026
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure) Critical
CVE-2026-59971 was published for mysql-mcp-server (pip) Sep 11, 2026
designcomputer Credited to designcomputer
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper... High Unreviewed
CVE-2026-78807 was published Sep 11, 2026
Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote... Moderate Unreviewed
CVE-2026-87563 was published Sep 9, 2026
Origin validation error in Windows DNS allows an unauthorized attacker to perform spoofing over a... High Unreviewed
CVE-2026-69680 was published Sep 8, 2026
Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose... Moderate Unreviewed
CVE-2026-69559 was published Sep 8, 2026
Origin validation error in .NET allows an unauthorized attacker to disclose information over a... Moderate Unreviewed
CVE-2026-58649 was published Sep 8, 2026
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience... Critical Unreviewed
CVE-2026-75156 was published Sep 8, 2026
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the... High Unreviewed
CVE-2026-84482 was published Sep 2, 2026
TYPO3 CMS - Broken Access Control in Backend and Install Tool High
CVE-2026-19418 was published for typo3/cms-backend (Composer) Sep 1, 2026
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox... Critical Unreviewed
CVE-2026-84140 was published Sep 1, 2026
Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155 and... Moderate Unreviewed
CVE-2026-84137 was published Sep 1, 2026
Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in... Critical Unreviewed
CVE-2026-84133 was published Sep 1, 2026
Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox... Critical Unreviewed
CVE-2026-84129 was published Sep 1, 2026
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to... Moderate Unreviewed
CVE-2026-70309 was published Aug 28, 2026
Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual... Low Unreviewed
CVE-2026-59297 was published Aug 27, 2026
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the... High Unreviewed
CVE-2026-81100 was published Aug 27, 2026
The Dash MCP server bound its listener to the loopback address but never checked the host a... Low Unreviewed
CVE-2026-81102 was published Aug 27, 2026
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying... High Unreviewed
CVE-2026-81099 was published Aug 27, 2026
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK... High Unreviewed
CVE-2026-81095 was published Aug 27, 2026
mcp-go accepted requests on its HTTP transports without checking the Host header.... High Unreviewed
CVE-2026-81092 was published Aug 27, 2026
genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport High
CVE-2026-55637 was published for github.com/geiserx/genieacs-mcp (Go) Aug 25, 2026
avishaigonen-pluto Credited to avishaigonen-pluto and yotampe-pluto yotampe-pluto yotampe-pluto
PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP server High
CVE-2026-55532 was published for PraisonAI (pip) Aug 25, 2026
geo-chen Credited to geo-chen
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database