Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

3,104 advisories

Loading
Tina: Code injection via unescaped Git branch name in generated client source High
CVE-2026-108259 was published for @tinacms/cli (npm) Oct 9, 2026
canhieu Credited to canhieu
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS High
CVE-2026-108260 was published for @tinacms/web-components (npm) Oct 9, 2026
sondt99 Credited to sondt99 and iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set High
CVE-2026-107720 was published for fast-jwt (npm) Oct 8, 2026
Char0n1507 Credited to Char0n1507
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array High
CVE-2026-107723 was published for fast-jwt (npm) Oct 8, 2026
rtvkiz Credited to rtvkiz
fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgery High
CVE-2026-107724 was published for fast-jwt (npm) Oct 8, 2026
the-vibe-dev Credited to the-vibe-dev
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure High
CVE-2026-61426 was published for praisonai (npm) Oct 8, 2026
dinhvaren Credited to dinhvaren
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES High
CVE-2026-107385 was published for mariadb (npm) Oct 8, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries) High
CVE-2026-107384 was published for mariadb (npm) Oct 8, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters High
CVE-2026-107383 was published for mariadb (npm) Oct 8, 2026
fg0x0 Credited to fg0x0
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort High
CVE-2026-107375 was published for generator-jhipster (npm) Oct 8, 2026
qrn12580 Credited to qrn12580
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob High
CVE-2026-107303 was published for generator-jhipster (npm) Oct 8, 2026
1491342590 Credited to 1491342590
msgpack5: Truncated map32 headers throw an unexpected error High
CVE-2026-107302 was published for msgpack5 (npm) Oct 8, 2026
SWIFI-AI Credited to SWIFI-AI
msgpack5: Many buffered values can exhaust the streaming decoder stack High
CVE-2026-107300 was published for msgpack5 (npm) Oct 8, 2026
SWIFI-AI Credited to SWIFI-AI
Ghost: Remote Code Execution via Bookmark Card Images High
CVE-2026-105642 was published for ghost (npm) Oct 7, 2026
rafabd1 Credited to rafabd1
Ghost: Stored XSS via Embed Card Previews High
CVE-2026-105643 was published for ghost (npm) Oct 7, 2026
DONG2209 Credited to DONG2209
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization High
CVE-2026-105649 was published for ghost (npm) Oct 7, 2026
5255fgh Credited to 5255fgh and nhattanhh nhattanhh nhattanhh
Next.js has Server-Side Request Forgery in Image Optimization High
CVE-2026-94483 was published for next (npm) Oct 7, 2026
Payload: SQL injection in SQLite/Postgres High
CVE-2026-105856 was published for @payloadcms/db-d1-sqlite (npm) Oct 7, 2026
HussienMisbah Credited to HussienMisbah
Payload: Remote Code Execution through first-register High
CVE-2026-105858 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload has a tenant authorization bypass in Multi-Tenant Plugin High
CVE-2026-105860 was published for @payloadcms/plugin-multi-tenant (npm) Oct 7, 2026
meifukun Credited to meifukun
Payload external upload trust validation issue High
CVE-2026-105861 was published for payload (npm) Oct 7, 2026
Payload: Bypassed sanitization of user uploaded SVGs High
CVE-2026-105862 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic and The4v1 The4v1 The4v1
Payload: Incomplete validation during the upload file lifecycle High
CVE-2026-105865 was published for payload (npm) Oct 7, 2026
EchoSkorJjj Credited to EchoSkorJjj
Payload: Client uploads could overwrite S3 objects High
CVE-2026-105867 was published for @payloadcms/storage-s3 (npm) Oct 7, 2026
koyokr Credited to koyokr
Payload: Uploaded XML files could execute same-origin JavaScript High
CVE-2026-105868 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database