Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

57 advisories

Loading
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter` High
CVE-2026-103030 was published for dio_http2_adapter (Pub) Oct 15, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS High
CVE-2026-104827 was published for react/http (Composer) Oct 15, 2026
EQSTLab Credited to EQSTLab, WyriHaximus, and 232-323 WyriHaximus WyriHaximus
232-323 232-323
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service High
CVE-2026-107839 was published for github.com/luskaner/ageLANServer/server (Go) Oct 9, 2026
EQSTLab Credited to EQSTLab
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor High
CVE-2026-103921 was published for @graphql-tools/executor-legacy-ws (npm) Oct 5, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions Critical
CVE-2026-10032 was published for @a2ui/web_core (npm) Oct 2, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests High
CVE-2026-57443 was published for scbe-aethermoore (pip) Sep 25, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint) High
CVE-2026-59723 was published for cline (npm) Sep 24, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata High
CVE-2026-61782 was published for @rsdoctor/rspack-plugin (npm) Sep 24, 2026
EQSTLab Credited to EQSTLab
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path High
CVE-2026-77246 was published for mcp-atlassian (pip) Sep 22, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion High
GHSA-xwmw-prc4-v3cr was published for github.com/obot-platform/obot (Go) Sep 18, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover Critical
CVE-2026-59151 was published for prowler-cloud (pip) Sep 11, 2026
EQSTLab Credited to EQSTLab, AdriiiPRodri, jfagoagas, and josema-xyz AdriiiPRodri AdriiiPRodri
jfagoagas jfagoagas josema-xyz josema-xyz
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission High
CVE-2026-59965 was published for @jhb.software/payload-alt-text-plugin (npm) Sep 10, 2026
EQSTLab Credited to EQSTLab, 232-323, and Kxrma47 232-323 232-323
Kxrma47 Kxrma47
@argos-ci/core: CI Branch Name OS Command Injection High
CVE-2026-59960 was published for @argos-ci/core (npm) Sep 10, 2026
EQSTLab Credited to EQSTLab and yym8538 yym8538 yym8538
mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS High
GHSA-m3wp-48jr-vr4g was published for mistralrs-server-core (Rust) Sep 10, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
@openhop/server: Path Traversal in Flow ID File Operations High
CVE-2026-59179 was published for @openhop/server (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import High
CVE-2026-59176 was published for functype-mcp-server (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run High
CVE-2026-59160 was published for @yeger/turbo-graph (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients High
CVE-2026-59158 was published for nuxt-ollama (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop High
GHSA-7q9c-hpx7-9cwm was published for @typespec/spector (npm) Sep 4, 2026
EQSTLab Credited to EQSTLab
Plate: SSRF with response disclosure in DOCX image embedding High
CVE-2026-65842 was published for @platejs/docx-io (npm) Sep 2, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()` High
CVE-2026-55585 was published for qwed (pip) Aug 25, 2026
EQSTLab Credited to EQSTLab
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion High
GHSA-8cp3-qxj6-px34 was published for utcp-http (pip) Aug 25, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable High
CVE-2026-55581 was published for github.com/sonirico/mcp-shell (Go) Aug 25, 2026
EQSTLab Credited to EQSTLab, useworld, and sonirico useworld useworld
sonirico sonirico
mcp-shell has a Secure Mode Allowlist Bypass via Git Shell Alias High
CVE-2026-55582 was published for github.com/sonirico/mcp-shell (Go) Aug 25, 2026
EQSTLab Credited to EQSTLab and sonirico sonirico sonirico
vouch-proxy has an Unbounded Multipart Cookie Allocation DoS High
CVE-2026-55149 was published for github.com/vouch/vouch-proxy (Go) Aug 20, 2026
EQSTLab Credited to EQSTLab and yym8538 yym8538 yym8538
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database