Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

341 advisories

Loading
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check... Moderate Unreviewed
CVE-2026-107160 was published Oct 14, 2026
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is... Moderate Unreviewed
CVE-2026-108069 was published Oct 14, 2026
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of... Moderate Unreviewed
CVE-2026-103308 was published Oct 14, 2026
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was... Moderate Unreviewed
CVE-2026-82844 was published Oct 14, 2026
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming... Moderate Unreviewed
CVE-2026-88998 was published Oct 14, 2026
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly... Moderate Unreviewed
CVE-2026-103324 was published Oct 15, 2026
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a... Moderate Unreviewed
CVE-2026-92429 was published Oct 15, 2026
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a... Moderate Unreviewed
CVE-2026-92428 was published Oct 15, 2026
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation Moderate
CVE-2026-102682 was published for pipecat-ai (pip) Oct 15, 2026
infycore Credited to infycore and agent-kira agent-kira agent-kira
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key,... Moderate Unreviewed
CVE-2026-111392 was published Oct 16, 2026
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not... Moderate Unreviewed
CVE-2026-103311 was published Oct 19, 2026
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its... Moderate Unreviewed
CVE-2026-74922 was published Oct 19, 2026
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a... Moderate Unreviewed
CVE-2026-86791 was published Oct 19, 2026
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of... Moderate Unreviewed
CVE-2026-103301 was published Oct 21, 2026
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment... Moderate Unreviewed
CVE-2026-104641 was published Oct 21, 2026
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that... Moderate Unreviewed
CVE-2026-105256 was published Oct 21, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database