Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

795 advisories

Loading
MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packet injection... High Unreviewed
CVE-2026-85431 was published Sep 4, 2026
MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that... High Unreviewed
CVE-2026-85430 was published Sep 4, 2026
MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body... High Unreviewed
CVE-2026-85429 was published Sep 4, 2026
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. Moderate Unreviewed
CVE-2026-84767 was published Sep 3, 2026
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning Moderate
CVE-2026-73846 was published for @aborruso/ckan-mcp-server (npm) Sep 3, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) Moderate
CVE-2026-73840 was published for github.com/openchoreo/openchoreo (Go) Sep 2, 2026
ihopenre-eng Credited to ihopenre-eng
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM... High Unreviewed
CVE-2023-20576 was published Sep 2, 2026
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption... Moderate Unreviewed
CVE-2026-20355 was published Sep 2, 2026
The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment... Moderate Unreviewed
CVE-2026-83533 was published Sep 2, 2026
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of... High Unreviewed
CVE-2026-19219 was published Sep 2, 2026
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an... Moderate Unreviewed
CVE-2026-79621 was published Sep 2, 2026
A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This... Low Unreviewed
CVE-2026-82811 was published Aug 31, 2026
A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome.... Low Unreviewed
CVE-2026-82813 was published Aug 31, 2026
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient... Critical Unreviewed
CVE-2026-82858 was published Aug 31, 2026
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build... Critical Unreviewed
CVE-2026-19410 was published Aug 31, 2026
A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function... Moderate Unreviewed
CVE-2026-82549 was published Aug 30, 2026
pac4j-saml before 6.5.6 does not require signature validation of SAML LogoutRequest messages in... Moderate Unreviewed
CVE-2026-82465 was published Aug 29, 2026
pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without... Moderate Unreviewed
CVE-2026-82462 was published Aug 29, 2026
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter... High Unreviewed
CVE-2026-82017 was published Aug 29, 2026
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and... Critical Unreviewed
CVE-2026-81706 was published Aug 27, 2026
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities... Critical Unreviewed
CVE-2026-81702 was published Aug 27, 2026
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check High
GHSA-mf7q-r4rv-jv94 was published for github.com/crossplane/crossplane-runtime/v2 (Go) Aug 27, 2026
tonghuaroot Credited to tonghuaroot and bugbunny-research bugbunny-research bugbunny-research
mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation) Moderate
CVE-2026-55663 was published for mediasoup (npm) Aug 25, 2026
geo-chen Credited to geo-chen
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote... Moderate Unreviewed
CVE-2026-78417 was published Aug 24, 2026
SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package... Moderate Unreviewed
CVE-2026-62204 was published Aug 22, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database