Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

263 advisories

Loading
Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin Moderate
GHSA-989h-w3q9-3m2f was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 22, 2026 • withdrawn
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header High
CVE-2026-54167 was published for github.com/openshift-pipelines/pipelines-as-code (Go) Aug 20, 2026
Triton VM Soundness Vulnerability due to Missing Constraint Moderate
GHSA-vjf8-9fx6-mv6x was published for triton-vm (Rust) Aug 18, 2026
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage High
CVE-2026-53728 was published for @medplum/core (npm) Aug 17, 2026
sAjibuu Credited to sAjibuu
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth High
CVE-2026-54763 was published for github.com/traefik/traefik/v2 (Go) Aug 6, 2026
matte1782 Credited to matte1782
Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false Moderate
CVE-2026-54764 was published for github.com/traefik/traefik (Go) Aug 6, 2026
Pig-Tail Credited to Pig-Tail
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning High
CVE-2026-68945 was published for @angular/common (npm) Aug 3, 2026
Hexix23 Credited to Hexix23, alan-agius4, and JeanMeche alan-agius4 alan-agius4
JeanMeche JeanMeche
OmniFaces: Forged combined-resource IDs and related output/push boundaries High
CVE-2026-102695 was published for org.omnifaces:omnifaces (Maven) Jul 24, 2026
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) High
GHSA-pvcr-8mvp-w8qr was published for @budibase/server (npm) Jul 24, 2026
hypnguyen1209 Credited to hypnguyen1209
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in High
GHSA-qq9h-g4jm-xgf3 was published for better-auth (npm) Jul 24, 2026
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them Moderate
CVE-2026-73419 was published for @auth/core (npm) Jul 23, 2026
Nadav0077 Credited to Nadav0077
n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login High
GHSA-8342-988q-86cr was published for n8n (npm) Jul 22, 2026
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability High
CVE-2026-47304 was published for System.Security.Cryptography.Xml (NuGet) Jul 20, 2026
rbhanda Credited to rbhanda
Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id="toc_N"` content Moderate
CVE-2026-59930 was published for mistune (pip) Jul 20, 2026
offset Credited to offset
melange: Incomplete package integrity verification allows data section substitution High
CVE-2026-54174 was published for chainguard.dev/apko (Go) Jul 10, 2026
xnox Credited to xnox and egibs egibs egibs
sigstore-go has a multi-log threshold bypass via single compromised log Moderate
CVE-2026-49834 was published for github.com/sigstore/sigstore-go (Go) Jul 9, 2026
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints Critical
CVE-2026-53513 was published for @better-auth/sso (npm) Jul 7, 2026
vaadata-poyetont Credited to vaadata-poyetont
Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email High
CVE-2026-53516 was published for better-auth (npm) Jul 7, 2026
avrmeduard Credited to avrmeduard
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin High
CVE-2026-53514 was published for better-auth (npm) Jul 7, 2026
widavies Credited to widavies
Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins Critical
CVE-2026-53512 was published for better-auth (npm) Jul 7, 2026
subhanUmer Credited to subhanUmer
Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness Critical
CVE-2026-54496 was published for halo2_gadgets (Rust) Jul 6, 2026
defuse Credited to defuse, nuttycom, daira, conradoplg, mpguerra, and alchemydc nuttycom nuttycom
daira daira conradoplg conradoplg mpguerra mpguerra alchemydc alchemydc
Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access Moderate
CVE-2026-55430 was published for github.com/coder/coder/v2 (Go) Jul 6, 2026
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo` High
CVE-2026-49284 was published for simplesamlphp/simplesamlphp (Composer) Jul 2, 2026
kamil-sawicki Credited to kamil-sawicki
Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block Moderate
CVE-2026-52737 was published for zebra-consensus (Rust) Jul 2, 2026
ipwning Credited to ipwning, mpguerra, conradoplg, and oxarbitrage mpguerra mpguerra
conradoplg conradoplg oxarbitrage oxarbitrage
OpenClaw: Trusted retry endpoint checks could match hostname prefixes High
GHSA-77q5-rr5v-x43q was published for openclaw (npm) Jul 2, 2026
ccy41928-del Credited to ccy41928-del
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database