Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

70 advisories

Loading
Mattermost makes Use of Weak Hash Moderate
CVE-2025-9078 was published for github.com/mattermost/mattermost-server (Go) Sep 15, 2025
CWE-328: Use of Weak Hash Moderate Unreviewed
CVE-2025-55053 was published Sep 9, 2025
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak... Moderate Unreviewed
CVE-2025-54535 was published Jul 28, 2025
Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e... High Unreviewed
CVE-2025-41256 was published Jun 26, 2025
The application uses a weak password hash function, allowing an attacker to crack the weak... Moderate Unreviewed
CVE-2025-49197 was published Jun 12, 2025
Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data... Moderate Unreviewed
CVE-2024-23589 was published May 30, 2025
The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up... Low Unreviewed
CVE-2025-48931 was published May 28, 2025
IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6... Moderate Unreviewed
CVE-2024-38341 was published May 28, 2025
The devices are vulnerable to an authentication bypass due to flaws in the authorization... Critical Unreviewed
CVE-2025-41652 was published May 27, 2025
pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting Moderate
CVE-2024-47829 was published for pnpm (npm) Apr 23, 2025
kexinoh Credited to kexinoh
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4... Moderate Unreviewed
CVE-2025-3576 was published Apr 15, 2025
Jujutsu does not have SHA-1 collision detection Moderate
GHSA-794x-2rpg-rfgr was published for jj-cli (Rust) Apr 7, 2025
emilazy Credited to emilazy
gitoxide does not detect SHA-1 collision attacks Moderate
CVE-2025-31130 was published for gitoxide (Rust) Apr 4, 2025
emilazy Credited to emilazy and EliahKagan EliahKagan EliahKagan
SageMaker Workflow component allows possibility of MD5 hash collisions Moderate
CVE-2025-0508 was published for sagemaker (pip) Mar 20, 2025
The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password... Critical Unreviewed
CVE-2025-27595 was published Mar 14, 2025
A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote... Moderate Unreviewed
CVE-2024-10026 was published Jan 30, 2025
Web installer integrity check used weak hash algorithm. The following products are affected:... Moderate Unreviewed
CVE-2024-56414 was published Jan 2, 2025
Beego has Collision Hazards of MD5 in Cache Key Filenames Moderate
CVE-2024-55885 was published for github.com/beego/beego (Go) Dec 12, 2024
kexinoh Credited to kexinoh
MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application... High Unreviewed
CVE-2024-48847 was published Dec 5, 2024
MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow Moderate
CVE-2024-48924 was published for MessagePack (NuGet) Oct 17, 2024
AArnott Credited to AArnott, neuecc, and GrabYourPitchforks neuecc neuecc
GrabYourPitchforks GrabYourPitchforks
Dozzle uses unsafe hash for passwords Low
CVE-2024-47182 was published for github.com/amir20/dozzle (Go) Oct 9, 2024
mohammed90 Credited to mohammed90
Certain switch models from PLANET Technology use an insecure hashing function to hash user... Moderate Unreviewed
CVE-2024-8453 was published Sep 30, 2024
Beego privilege escalation vulnerability High
CVE-2024-40465 was published for github.com/beego/beego/v2 (Go) Jul 31, 2024
An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to... Moderate Unreviewed
CVE-2024-32211 was published May 1, 2024
Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can... Moderate Unreviewed
CVE-2024-1040 was published Feb 2, 2024
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database