Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

732 advisories

Loading
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose... Moderate Unreviewed
CVE-2026-88132 was published Oct 13, 2026
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code... High Unreviewed
CVE-2026-70213 was published Oct 13, 2026
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information... Moderate Unreviewed
CVE-2026-69877 was published Oct 13, 2026
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability Moderate
CVE-2026-96234 was published for Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Oct 13, 2026
Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation... Moderate Unreviewed
CVE-2026-103417 was published Oct 13, 2026
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer... Low Unreviewed
CVE-2026-109332 was published Oct 12, 2026
Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in... High Unreviewed
CVE-2026-109286 was published Oct 12, 2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not... Critical Unreviewed
CVE-2026-9191 was published Oct 12, 2026
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout Moderate
CVE-2026-107804 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
lujiefsi Credited to lujiefsi
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment Critical
CVE-2026-108261 was published for @tinacms/app (npm) Oct 9, 2026
sondt99 Credited to sondt99
PraisonAI: Call API localhost-only authentication bypass via spoofed Host header High
CVE-2026-61435 was published for praisonai (pip) Oct 8, 2026
rexpository Credited to rexpository
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header Moderate
CVE-2026-107292 was published for pydantic-ai (pip) Oct 8, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint High
CVE-2026-107295 was published for pydantic-ai (pip) Oct 8, 2026
sondt99 Credited to sondt99
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins High
CVE-2026-107230 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
Missing Host header validation and missing throttling of failed administrator sign-ins in the... High Unreviewed
CVE-2026-104659 was published Oct 8, 2026
Next.js has information disclosure in development server's Model Context Protocol endpoint Low
CVE-2026-94486 was published for next (npm) Oct 7, 2026
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass Moderate
CVE-2026-94485 was published for next (npm) Oct 7, 2026
Payload external upload trust validation issue High
CVE-2026-105861 was published for payload (npm) Oct 7, 2026
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path Critical
CVE-2026-103922 was published for @capacitor/android (Maven) Oct 5, 2026
andredestro Credited to andredestro
Heym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that... Moderate Unreviewed
CVE-2026-105396 was published Oct 5, 2026
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass Low
CVE-2026-74802 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 2, 2026
alham-rizvi Credited to alham-rizvi
A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery ... Moderate Unreviewed
CVE-2026-102588 was published Sep 30, 2026
mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP... High Unreviewed
CVE-2026-102878 was published Sep 29, 2026
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors High
CVE-2026-85152 was published for undici (npm) Sep 29, 2026
nikolakojic-rasit Credited to nikolakojic-rasit, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab High
CVE-2026-102673 was published for electron (npm) Sep 29, 2026
varisys Credited to varisys
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database