Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

732 advisories

Loading
PraisonAI has an origin validation bypass in MCP HTTP Stream transport that allows browser-mediated unauthenticated tool execution on local MCP server Moderate
CVE-2026-55529 was published for PraisonAI (pip) Aug 25, 2026
hoanggxyuuki Credited to hoanggxyuuki and NguyenHuyTrung NguyenHuyTrung NguyenHuyTrung
Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match Critical
GHSA-qh7h-6c7g-x8m6 was published for getgrav/grav (Composer) Aug 25, 2026 • withdrawn
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689) Moderate
CVE-2026-67448 was published for github.com/axllent/mailpit (Go) Aug 20, 2026
arpitjain099 Credited to arpitjain099
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:... High Unreviewed
CVE-2026-62442 was published Aug 18, 2026
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).... High Unreviewed
CVE-2026-60765 was published Aug 18, 2026
Site isolation issue in the Audio/Video: Web Codecs component. This vulnerability was fixed in... High Unreviewed
CVE-2026-74981 was published Aug 18, 2026
Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in... Moderate Unreviewed
CVE-2026-74974 was published Aug 18, 2026
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in... Moderate Unreviewed
CVE-2026-74968 was published Aug 18, 2026
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154 and... Moderate Unreviewed
CVE-2026-74970 was published Aug 18, 2026
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in... Moderate Unreviewed
CVE-2026-74967 was published Aug 18, 2026
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in... Moderate Unreviewed
CVE-2026-74963 was published Aug 18, 2026
Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in... High Unreviewed
CVE-2026-74962 was published Aug 18, 2026
Duplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass Low
GHSA-x8p6-569w-fmmr was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 17, 2026 • withdrawn
The web interface of the affected device relies on the HTTP referrer header as part of request... Moderate Unreviewed
CVE-2026-15141 was published Aug 13, 2026
The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys... Moderate Unreviewed
CVE-2026-18676 was published Aug 12, 2026
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive... High Unreviewed
CVE-2026-18098 was published Aug 12, 2026
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials... High Unreviewed
CVE-2026-18847 was published Aug 12, 2026
Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized... High Unreviewed
CVE-2026-56179 was published Aug 11, 2026
Duplicate Advisory: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool High
GHSA-4f2f-jr2m-j7p4 was published for typo3/cms-core (Composer) Aug 11, 2026 • withdrawn
Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability... High Unreviewed
CVE-2026-66732 was published Aug 6, 2026
Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on... Critical Unreviewed
CVE-2026-15587 was published Aug 5, 2026
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity... High Unreviewed
CVE-2026-16442 was published Aug 5, 2026
Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin Moderate
CVE-2026-70599 was published for electron (npm) Aug 5, 2026
offset Credited to offset
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to... High Unreviewed
CVE-2026-66322 was published Aug 4, 2026
Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to... High Unreviewed
CVE-2026-66318 was published Aug 4, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database