Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

79 advisories

Loading
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin Low
CVE-2026-62994 was published for github.com/coredns/coredns (Go) Oct 16, 2026
sondt99 Credited to sondt99
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment Critical
CVE-2026-108261 was published for @tinacms/app (npm) Oct 9, 2026
sondt99 Credited to sondt99
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS High
CVE-2026-108260 was published for @tinacms/web-components (npm) Oct 9, 2026
sondt99 Credited to sondt99 and iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) Critical
CVE-2026-106446 was published for handlebars (npm) Oct 8, 2026
ndelphit Credited to ndelphit, bhaswanthc, dinhvaren, jmoritzc53, n0tra4e, hibrian827, sondt99, nikolakojic-rasit, Ahmed-Elmahgob, vk-can, PellaML, shenhuanageshei, kagebunsher, kustundag, ffasterss, and sanmatte bhaswanthc bhaswanthc
dinhvaren dinhvaren jmoritzc53 jmoritzc53 n0tra4e n0tra4e hibrian827 hibrian827 sondt99 sondt99 nikolakojic-rasit nikolakojic-rasit Ahmed-Elmahgob Ahmed-Elmahgob vk-can vk-can PellaML PellaML shenhuanageshei shenhuanageshei kagebunsher kagebunsher kustundag kustundag ffasterss ffasterss sanmatte sanmatte
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint High
CVE-2026-107295 was published for pydantic-ai (pip) Oct 8, 2026
sondt99 Credited to sondt99
Ghost: Stored XSS via Bookmark Card Images High
CVE-2026-105651 was published for ghost (npm) Oct 7, 2026
sondt99 Credited to sondt99 and 5255fgh 5255fgh 5255fgh
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM High
CVE-2026-92959 was published for vm2 (npm) Oct 5, 2026
sondt99 Credited to sondt99 and dungNHVhust dungNHVhust dungNHVhust
Socket.IO: Engine.IO Protocol Revision Mismatch DoS High
CVE-2026-102599 was published for engine.io (npm) Sep 29, 2026
sondt99 Credited to sondt99
lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses Moderate
CVE-2026-85709 was published for lightrag-hku (pip) Sep 22, 2026
sondt99 Credited to sondt99 and dungNHVhust dungNHVhust dungNHVhust
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service Moderate
CVE-2026-77561 was published for github.com/steveiliop56/tinyauth (Go) Sep 22, 2026
sondt99 Credited to sondt99
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions Moderate
CVE-2026-77250 was published for mcp-atlassian (pip) Sep 22, 2026
sondt99 Credited to sondt99
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files High
CVE-2026-77253 was published for mcp-atlassian (pip) Sep 22, 2026
sondt99 Credited to sondt99
HAPI FHIR: SHCParser DEFLATE infinite loop causes denial of service High
CVE-2026-81876 was published for ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven) Sep 17, 2026
sondt99 Credited to sondt99
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service High
CVE-2026-81875 was published for ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven) Sep 17, 2026
sondt99 Credited to sondt99
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured High
CVE-2026-78682 was published for nltk (pip) Sep 8, 2026
sondt99 Credited to sondt99
SurrealDB: Writes in a PERMISSIONS clause bypass table permissions Moderate
CVE-2026-63733 was published for surrealdb-core (Rust) Sep 4, 2026
sondt99 Credited to sondt99
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path High
CVE-2026-63735 was published for surrealdb (Rust) Sep 4, 2026
sondt99 Credited to sondt99
CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository High
CVE-2026-75911 was published for codewhale (npm) Sep 4, 2026
sondt99 Credited to sondt99 and dungNHVhust dungNHVhust dungNHVhust
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository High
CVE-2026-75859 was published for codewhale (npm) Sep 4, 2026
sondt99 Credited to sondt99, dungNHVhust, and sai-sh dungNHVhust dungNHVhust
sai-sh sai-sh
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root Moderate
CVE-2026-61625 was published for github.com/VictoriaMetrics/VictoriaMetrics (Go) Sep 3, 2026
sondt99 Credited to sondt99, dungNHVhust, arkid15r, and makasim dungNHVhust dungNHVhust
arkid15r arkid15r makasim makasim
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections Moderate
CVE-2026-81890 was published for studio-42/elfinder (Composer) Sep 2, 2026
sondt99 Credited to sondt99 and dungNHVhust dungNHVhust dungNHVhust
arc has unauthenticated cluster node admission when `cluster.shared_secret` is unset Moderate
CVE-2026-55678 was published for github.com/basekick-labs/arc (Go) Aug 28, 2026
sondt99 Credited to sondt99
YOURLS has stored XSS in referrer statistics chart via crafted Referer header High
CVE-2026-63135 was published for yourls/yourls (Composer) Aug 21, 2026
sondt99 Credited to sondt99, dgw, ozh, and LeoColomb dgw dgw
ozh ozh LeoColomb LeoColomb
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary High
CVE-2026-63124 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
sondt99 Credited to sondt99 and VuiVeIshere VuiVeIshere VuiVeIshere
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash Moderate
CVE-2026-61799 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
sondt99 Credited to sondt99
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database