Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

180 advisories

Loading
NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval injection. A... High Unreviewed
CVE-2026-65141 was published Oct 13, 2026
Affected devices do not properly restrict executable content contained in imported trace files. ... Critical Unreviewed
CVE-2026-63350 was published Oct 13, 2026
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source High
CVE-2026-61433 was published for praisonai (pip) Oct 8, 2026
rexpository Credited to rexpository
Brocade ASCG before 3.5.0 improperly processes user input by evaluating form data prior to... High Unreviewed
CVE-2026-85486 was published Oct 8, 2026
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation Critical
CVE-2026-10561 was published for langflow (pip) Oct 6, 2026
XlabAITeam Credited to XlabAITeam, pkuGenuine, keenanwgn, andifilhohub, and erichare pkuGenuine pkuGenuine
keenanwgn keenanwgn andifilhohub andifilhohub erichare erichare
The application uses unsafe functions that allow execution of inline scripts and string... Low Unreviewed
CVE-2026-69662 was published Sep 30, 2026
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() High
CVE-2026-65954 was published for phpcsstandards/phpcsutils (Composer) Sep 29, 2026
rodrigoprimo Credited to rodrigoprimo, FORIMOC, edorian, and jrfnl FORIMOC FORIMOC
edorian edorian jrfnl jrfnl
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer,... Critical Unreviewed
CVE-2026-100741 was published Sep 27, 2026
MONAI through 1.6.0 contains an eval injection vulnerability in _get_fake_spatial_shape() in... High Unreviewed
CVE-2026-100842 was published Sep 27, 2026
MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration... High Unreviewed
CVE-2026-100840 was published Sep 27, 2026
plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection Critical
CVE-2026-57149 was published for plone.app.portlets (pip) Sep 23, 2026
Cyber-JA Credited to Cyber-JA
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An... Moderate Unreviewed
CVE-2026-76974 was published Sep 22, 2026
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib... Critical Unreviewed
CVE-2026-78847 was published Sep 22, 2026
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue Critical
CVE-2025-53837 was published for org.xwiki.rendering:xwiki-rendering-xml (Maven) Sep 18, 2026
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote... High Unreviewed
CVE-2026-19780 was published Sep 15, 2026
An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue... High Unreviewed
CVE-2026-82789 was published Sep 14, 2026
Improper neutralization of directives in dynamically evaluated code ('eval injection')... Critical Unreviewed
CVE-2026-80351 was published Sep 10, 2026
The Okta Access Gateway management console passes user-supplied input to eval() without... Moderate Unreviewed
CVE-2026-78550 was published Sep 8, 2026
ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ... High Unreviewed
CVE-2026-76190 was published Sep 8, 2026
ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ... Critical Unreviewed
CVE-2026-48273 was published Sep 8, 2026
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/-... High Unreviewed
CVE-2026-79678 was published Sep 7, 2026
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator Critical
CVE-2026-71867 was published for orval (npm) Sep 3, 2026
Gal3m Credited to Gal3m, mrostamipoor, and aqeelat mrostamipoor mrostamipoor
aqeelat aqeelat
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli Critical
CVE-2026-71865 was published for orval (npm) Sep 3, 2026
Gal3m Credited to Gal3m, mrostamipoor, and aqeelat mrostamipoor mrostamipoor
aqeelat aqeelat
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client Critical
CVE-2026-71864 was published for orval (npm) Sep 3, 2026
Gal3m Credited to Gal3m, mrostamipoor, aqeelat, and mohammad228 mrostamipoor mrostamipoor
aqeelat aqeelat mohammad228 mohammad228
n8n versions before 2.36.2 contain an expression sandbox bypass vulnerability where free... High Unreviewed
CVE-2026-85165 was published Sep 3, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database