Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

215 advisories

Loading
An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited... Moderate Unreviewed
CVE-2026-24715 was published Oct 15, 2026
Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows... Moderate Unreviewed
CVE-2026-109379 was published Oct 12, 2026
A flaw was found in openstack-network-exporter. When an operator configures user authentication... High Unreviewed
CVE-2026-83535 was published Oct 12, 2026
Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that... Moderate Unreviewed
CVE-2026-107269 was published Oct 7, 2026
In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels:... Moderate Unreviewed
CVE-2026-18040 was published Oct 3, 2026
In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three... High Unreviewed
CVE-2026-18036 was published Oct 2, 2026
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is... Low Unreviewed
CVE-2026-54875 was published Sep 29, 2026
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values,... Low Unreviewed
CVE-2026-77696 was published Sep 29, 2026
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature... Low Unreviewed
CVE-2026-54872 was published Sep 29, 2026
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208) Moderate
CVE-2026-49265 was published for oauthlib (pip) Sep 29, 2026
Rickidevs Credited to Rickidevs
A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of... Critical Unreviewed
CVE-2026-77987 was published Sep 22, 2026
Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle Moderate
CVE-2026-88010 was published for Traefik (Go) Sep 22, 2026
lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function Moderate
CVE-2026-85725 was published for lightrag-hku (pip) Sep 22, 2026
MaramHarsha Credited to MaramHarsha
Tinyauth: User enumeration attack by timing oracle Moderate
CVE-2026-77582 was published for github.com/tinyauthapp/tinyauth (Go) Sep 22, 2026
darktohka Credited to darktohka
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack Critical
CVE-2026-63132 was published for github.com/openbao/openbao (Go) Sep 22, 2026
Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory) Moderate
CVE-2026-58272 was published for @sync-in/server (npm) Sep 22, 2026
456789TZ Credited to 456789TZ and johaven johaven johaven
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection Low
CVE-2026-72701 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
An issue was discovered in Nagios XI before 5.9.3. The is_insecure_login_authenticated function... Low Unreviewed
CVE-2023-24035 was published Sep 14, 2026
An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing... Moderate Unreviewed
CVE-2026-87737 was published Sep 9, 2026
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery Moderate
CVE-2026-84308 was published for phpseclib/phpseclib (Composer) Sep 8, 2026
geostergiop Credited to geostergiop and hexblot hexblot hexblot
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc... High Unreviewed
CVE-2026-16037 was published Sep 8, 2026
Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force.... Low Unreviewed
CVE-2026-81159 was published Sep 2, 2026
Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows... Moderate Unreviewed
CVE-2026-80199 was published Aug 31, 2026
Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check... Moderate Unreviewed
CVE-2026-82449 was published Aug 29, 2026
free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA Low
CVE-2026-55785 was published for github.com/free5gc/ausf (Go) Aug 28, 2026
jaimealruiz Credited to jaimealruiz and jav1er8 jav1er8 jav1er8
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database