GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
High
CVE-2026-49853
was published
for
tornado
(pip)
Jun 15, 2026
PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
High
CVE-2026-57129
was published
for
praisonaiagents
(pip)
Jun 18, 2026
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
High
CVE-2026-57130
was published
for
praisonaiagents
(pip)
Jun 18, 2026
Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration
High
CVE-2026-53925
was published
for
glances
(pip)
Jun 23, 2026
NLTK: pathsec SSRF protection can be bypassed when a proxy is configured
High
CVE-2026-78682
was published
for
nltk
(pip)
Sep 8, 2026
MCP Atlassian: Jira and Confluence attachment upload tools can read arbitrary server-local files
High
CVE-2026-77253
was published
for
mcp-atlassian
(pip)
Sep 22, 2026
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint
High
CVE-2026-107295
was published
for
pydantic-ai
(pip)
Oct 8, 2026
ProTip!
Advisories are also available from the
GraphQL API