Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

9 advisories

Loading
Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL High
CVE-2026-55797 was published for github.com/argoproj/argo-cd/v2 (Go) Oct 9, 2026
kamil-sawicki Credited to kamil-sawicki, yuvalelarat, cherez0ff, McCaulay, ria-labs-security, parameter-ai-security, and zwindler yuvalelarat yuvalelarat
cherez0ff cherez0ff McCaulay McCaulay ria-labs-security ria-labs-security parameter-ai-security parameter-ai-security zwindler zwindler
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write Critical
CVE-2026-58426 was published for code.gitea.io/gitea (Go) Jul 21, 2026
kamil-sawicki Credited to kamil-sawicki
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo` High
CVE-2026-49284 was published for simplesamlphp/simplesamlphp (Composer) Jul 2, 2026
kamil-sawicki Credited to kamil-sawicki
SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass High
CVE-2026-49283 was published for simplesamlphp/saml2 (Composer) Jul 2, 2026
kamil-sawicki Credited to kamil-sawicki, tvdijen, and vladimir-mencl-eresearch tvdijen tvdijen
vladimir-mencl-eresearch vladimir-mencl-eresearch
Gitea: Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routes High
CVE-2026-24791 was published for code.gitea.io/gitea (Go) Jun 17, 2026
kamil-sawicki Credited to kamil-sawicki
Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix Critical
CVE-2026-49980 was published for github.com/rclone/rclone (Go) Jun 16, 2026
kamil-sawicki Credited to kamil-sawicki and ncw ncw ncw
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts High
CVE-2026-53622 was published for github.com/traefik/traefik (Go) Jun 16, 2026
kamil-sawicki Credited to kamil-sawicki, westonsteimel, and rezmoss westonsteimel westonsteimel
rezmoss rezmoss
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass High
CVE-2026-48491 was published for github.com/traefik/traefik/v2 (Go) Jun 16, 2026
kamil-sawicki Credited to kamil-sawicki and westonsteimel westonsteimel westonsteimel
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion High
CVE-2026-46491 was published for simplesamlphp/simplesamlphp-module-casserver (Composer) May 15, 2026
kamil-sawicki Credited to kamil-sawicki
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database