Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

2,680 advisories

Loading
Talos Linux: Support bundle does not redact registry credentials Low
CVE-2026-77564 was published for github.com/talos-systems/talos (Go) Oct 15, 2026
Thanzex Credited to Thanzex
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters Low
CVE-2026-64655 was published for github.com/cli/cli/v2 (Go) Oct 15, 2026
babakks Credited to babakks, BagToad, helixplant, ajbeattie, and bdehamer BagToad BagToad
helixplant helixplant ajbeattie ajbeattie bdehamer bdehamer
GitHub CLI allows path traversal through unescaped request URL components Low
CVE-2026-64653 was published for github.com/cli/cli/v2 (Go) Oct 15, 2026
babakks Credited to babakks, BagToad, helixplant, and sam-kossey BagToad BagToad
helixplant helixplant sam-kossey sam-kossey
GitHub CLI partially discloses authentication tokens in `gh auth status` output Low
CVE-2026-64652 was published for github.com/cli/cli/v2 (Go) Oct 15, 2026
babakks Credited to babakks, BagToad, weshaggard, and shelbyc BagToad BagToad
weshaggard weshaggard shelbyc shelbyc
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction Low
CVE-2026-14966 was published for bbot (pip) Oct 14, 2026
tonghuaroot Credited to tonghuaroot
Apprise forwards configured auth headers across cross-origin HTTP redirects Low
CVE-2026-59180 was published for apprise (pip) Oct 14, 2026
gistrec Credited to gistrec
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal Low
GHSA-w2ch-4xgr-22ww was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Contao: Cross-site request forgery in custom backend actions Low
CVE-2026-107848 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Strawberry legacy graphql-ws retains naturally completed subscription slots Low
CVE-2026-107727 was published for strawberry-graphql (pip) Oct 9, 2026
Hama1cco Credited to Hama1cco
msgpack5: Decoding negative int64 values mutates the input buffer Low
CVE-2026-107296 was published for msgpack5 (npm) Oct 8, 2026
SWIFI-AI Credited to SWIFI-AI
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` Low
CVE-2026-107293 was published for pydantic-ai (pip) Oct 8, 2026
mauriceng98 Credited to mauriceng98 and sean-kim05 sean-kim05 sean-kim05
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False` Low
CVE-2026-107291 was published for pydantic-ai (pip) Oct 8, 2026
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source Low
CVE-2026-107283 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
Docling: Configured HTTP headers sent to every remote image host named by a document Low
CVE-2026-105742 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError Low
CVE-2026-106449 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
Next.js has information disclosure in development server's Model Context Protocol endpoint Low
CVE-2026-94486 was published for next (npm) Oct 7, 2026
Ghost: Password Hash Ordering Disclosure in Ghost Admin API Low
CVE-2026-105652 was published for ghost (npm) Oct 7, 2026
carfeii Credited to carfeii and nhattanhh nhattanhh nhattanhh
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service Low
CVE-2026-106101 was published for quasar (npm) Oct 7, 2026
lisusuy Credited to lisusuy
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend Low
CVE-2026-106487 was published for @backstage/plugin-kubernetes-backend (npm) Oct 7, 2026
Backstage: Cloud storage catalog locations may cross configured storage boundaries Low
CVE-2026-106493 was published for @backstage/backend-defaults (npm) Oct 7, 2026
Backstage: Inconsistent enforcement of allowed location types during catalog processing Low
CVE-2026-106496 was published for @backstage/plugin-catalog-backend (npm) Oct 7, 2026
Ghost: Server-Side Request Forgery in Webhook Trigger Low
CVE-2026-105682 was published for ghost (npm) Oct 7, 2026
0xkakash1 Credited to 0xkakash1, 0xBassia, l3tchupkt, rooks00, and Wernerina 0xBassia 0xBassia
l3tchupkt l3tchupkt rooks00 rooks00 Wernerina Wernerina
Ghost: Path Traversal Vulnerability in Ghost ImageSize Service Low
CVE-2026-105683 was published for ghost (npm) Oct 7, 2026
l3tchupkt Credited to l3tchupkt
Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests Low
CVE-2026-105795 was published for Microsoft.OpenApi.Kiota (NuGet) Oct 6, 2026
gavinbarron Credited to gavinbarron and adrian05-ms adrian05-ms adrian05-ms
i18next-http-backend incomplete URL validation permits SSRF Low
CVE-2026-105800 was published for i18next-http-backend (npm) Oct 6, 2026
avrlab233 Credited to avrlab233
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database