Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

123 advisories

Loading
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case... Low Unreviewed
CVE-2026-111448 was published Oct 16, 2026
Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling... Moderate Unreviewed
CVE-2026-108721 was published Oct 11, 2026
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether... Moderate Unreviewed
CVE-2026-105570 was published Oct 8, 2026
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences Moderate
CVE-2026-107381 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
arpitjain099 Credited to arpitjain099
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form... High Unreviewed
CVE-2026-89322 was published Oct 8, 2026
Backstage: Scaffolder action input authorization bypass High
CVE-2026-106503 was published for @backstage/plugin-scaffolder-backend (npm) Oct 7, 2026
fastify vulnerable to header validation bypass via incomplete schema case normalization High
CVE-2026-84428 was published for fastify (npm) Sep 30, 2026
schecthellraiser606 Credited to schecthellraiser606, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets Moderate
CVE-2026-86472 was published for fast-uri (npm) Sep 29, 2026
fg0x0 Credited to fg0x0, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the... High Unreviewed
CVE-2026-100693 was published Sep 26, 2026
Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are... High Unreviewed
CVE-2026-100669 was published Sep 26, 2026
OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensitivity in the... High Unreviewed
CVE-2026-100580 was published Sep 26, 2026
OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.2 and < 2026.8.1... High Unreviewed
CVE-2026-100541 was published Sep 26, 2026
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for High
CVE-2026-77560 was published for github.com/tinyauthapp/tinyauth (Go) Sep 22, 2026
5ud0er Credited to 5ud0er
Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass Moderate
CVE-2026-77281 was published for github.com/caddyserver/caddy/v2 (Go) Sep 18, 2026
WhiskerEnt Credited to WhiskerEnt
Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the... High Unreviewed
CVE-2026-89012 was published Sep 11, 2026
Snipe-IT before 8.7.0 fails to validate username case sensitivity during SAML authentication,... High Unreviewed
CVE-2026-86770 was published Sep 9, 2026
xmldom: HTML raw-text closing-tag case mismatch causes output amplification High
CVE-2026-83612 was published for @xmldom/xmldom (npm) Sep 8, 2026
KarimTantawey Credited to KarimTantawey
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion Moderate
CVE-2026-84303 was published for google.golang.org/grpc (Go) Sep 8, 2026
alimony Credited to alimony
Improper handling of case sensitivity in the configuration validation component of MongoDB Server... Critical Unreviewed
CVE-2026-82067 was published Sep 8, 2026
PocketMine-MP before 4.0.3 does not perform case-insensitive matching when removing operator... Moderate Unreviewed
CVE-2021-48006 was published Sep 6, 2026
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows... Moderate Unreviewed
CVE-2026-73476 was published Sep 2, 2026
Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65... Moderate Unreviewed
CVE-2026-78959 was published Aug 25, 2026
Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the... High Unreviewed
CVE-2026-59335 was published Aug 25, 2026
Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems High
CVE-2026-62673 was published for getgrav/grav (Composer) Aug 19, 2026
replit-svg Credited to replit-svg
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home... Critical Unreviewed
CVE-2026-72836 was published Aug 14, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database