GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
High
CVE-2026-84360
was published
for
github.com/0xJacky/Nginx-UI
(Go)
Oct 15, 2026
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Moderate
CVE-2026-84321
was published
for
github.com/0xJacky/Nginx-UI
(Go)
Oct 15, 2026
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
High
CVE-2026-107810
was published
for
github.com/0xJacky/Nginx-UI
(Go)
Oct 9, 2026
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Moderate
CVE-2026-32639
was published
for
winter/wn-cms-module
(Composer)
Aug 12, 2026
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
High
CVE-2026-52845
was published
for
github.com/caddyserver/caddy
(Go)
Jun 16, 2026
Caddy: Windows `file_server` path authorization bypass via encoded backslash
High
CVE-2026-52844
was published
for
github.com/caddyserver/caddy
(Go)
Jun 16, 2026
Twig: Possible sandbox bypass when using a source policy
High
CVE-2026-24425
was published
for
twig/twig
(Composer)
Jun 5, 2026
ProTip!
Advisories are also available from the
GraphQL API