Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

15,963 advisories

Loading
Metalama allows local code execution through DLL planting in shared temporary directories Moderate
CVE-2026-62847 was published for Metalama.Framework (NuGet) Oct 14, 2026
Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability Moderate
CVE-2026-96234 was published for Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability Moderate
CVE-2026-96229 was published for Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability Moderate
CVE-2026-85790 was published for Microsoft.Native.Quic.MsQuic.Schannel (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability Moderate
CVE-2026-66822 was published for Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability Moderate
GHSA-86xp-94pg-8r6r was published for Microsoft.AspNetCore.SignalR.Protocols.MessagePack (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability Moderate
CVE-2026-70162 was published for System.Security.Cryptography.Pkcs (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability Moderate
CVE-2026-70194 was published for Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability Moderate
CVE-2026-70196 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check Moderate
GHSA-fmmf-xq98-g327 was published for code.vikunja.io/api (Go) Oct 9, 2026
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) Moderate
GHSA-pjr3-86v4-5p7w was published for code.vikunja.io/api (Go) Oct 9, 2026
Viv3kGupt4 Credited to Viv3kGupt4
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed Moderate
GHSA-hjx8-qv73-f7cm was published for code.vikunja.io/api (Go) Oct 9, 2026
euriconicacio Credited to euriconicacio and Tan-JunWei Tan-JunWei Tan-JunWei
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants Moderate
GHSA-fprf-r6rv-xg99 was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes Moderate
GHSA-4hv6-xc92-j86g was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout Moderate
CVE-2026-107804 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
lujiefsi Credited to lujiefsi
Shiny for Python has path traversal in bookmark restore Moderate
CVE-2026-108258 was published for shiny (pip) Oct 9, 2026
0xRenSec Credited to 0xRenSec
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint Moderate
GHSA-8wvg-r2j4-3737 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: Cross-project task disclosure through subtask expansion Moderate
GHSA-3hc7-r24j-rpwc was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien and JellowBeanz26 JellowBeanz26 JellowBeanz26
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID Moderate
GHSA-g38j-7v97-x298 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled Moderate
CVE-2026-107842 was published for contao/core-bundle (Composer) Oct 9, 2026
iRevivalx Credited to iRevivalx
Contao: The registration module re-sends activation mails Moderate
CVE-2026-107843 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Path traversal in the images controller Moderate
CVE-2026-107844 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Improper access control in the preview links module Moderate
CVE-2026-107850 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Improper access control in the table access voter Moderate
CVE-2026-107851 was published for contao/core-bundle (Composer) Oct 9, 2026
sven-jaeger-git Credited to sven-jaeger-git
Vikunja: Link-share token can enumerate users through the v2 API Moderate
CVE-2026-91981 was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database