Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

39 advisories

Loading
Handlebars: JavaScript Injection via Own Property Check Bypass Critical
CVE-2026-106445 was published for handlebars (npm) Oct 8, 2026
brandon-t-elliott Credited to brandon-t-elliott
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers Moderate
CVE-2026-107289 was published for pydantic-ai (pip) Oct 8, 2026
euriconicacio Credited to euriconicacio
In affected versions of Octopus Server, an authenticated user with permission to modify roles... High Unreviewed
CVE-2026-102478 was published Oct 7, 2026
The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private... Moderate Unreviewed
CVE-2026-105048 was published Oct 3, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was... High Unreviewed
CVE-2026-100255 was published Sep 30, 2026
Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP... Critical Unreviewed
CVE-2026-97196 was published Sep 30, 2026
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per... Moderate Unreviewed
CVE-2026-100837 was published Sep 27, 2026
Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated... Moderate Unreviewed
CVE-2026-88255 was published Sep 16, 2026
SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist... Moderate Unreviewed
CVE-2026-76977 was published Sep 8, 2026
URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via... Moderate Unreviewed
CVE-2026-19953 was published Aug 31, 2026
Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits... High Unreviewed
CVE-2026-60074 was published Jul 30, 2026
Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries Low
GHSA-6c87-g9pw-78fx was published for github.com/edgelesssys/contrast (Go) Jul 1, 2026
offset Credited to offset
The Aqara Cloud OAuth Authorization Endpoint (open-cn.aqara.com/oauth/authorize) is vulnerable to... Critical Unreviewed
CVE-2026-50090 was published Jun 12, 2026
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. ... Moderate Unreviewed
CVE-2026-49940 was published Jun 4, 2026
Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion... High Unreviewed
CVE-2026-49942 was published Jun 4, 2026
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 Moderate
CVE-2026-47674 was published for hono (npm) Jun 4, 2026
offset Credited to offset and 0xEr3n 0xEr3n 0xEr3n
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks Moderate
CVE-2026-48710 was published for starlette (pip) Jun 4, 2026
x41j Credited to x41j, ehhthing, and nic-lovin ehhthing ehhthing
nic-lovin nic-lovin
symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form Low
CVE-2026-46644 was published for symfony/polyfill (Composer) May 28, 2026
nicolas-grekas Credited to nicolas-grekas
Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring High
CVE-2026-42462 was published for @fedify/fedify (npm) May 26, 2026
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an... Critical Unreviewed
CVE-2026-39821 was published May 26, 2026
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero... Moderate Unreviewed
CVE-2026-45191 was published May 10, 2026
Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask... Moderate Unreviewed
CVE-2026-45190 was published May 10, 2026
webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed Low
GHSA-22w3-693w-x895 was published for webauthn-authenticator-rs (Rust) May 6, 2026
dorakemon Credited to dorakemon
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode Moderate
CVE-2026-41239 was published for dompurify (npm) Apr 22, 2026
bencalif Credited to bencalif
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes Moderate
CVE-2026-41213 was published for @node-oauth/oauth2-server (npm) Apr 16, 2026
KarimTantawey Credited to KarimTantawey, jankapunkt, and dhensby jankapunkt jankapunkt
dhensby dhensby
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database