Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,063 advisories

Loading
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) High
GHSA-fr26-jjhm-638c was published for pyload-ng (pip) Oct 9, 2026
skeletonsec Credited to skeletonsec
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory High
CVE-2026-107377 was published for datamodel-code-generator (pip) Oct 8, 2026
alex131125 Credited to alex131125
PraisonAI: SkillTools Executes Scripts Without Path Containment Validation High
CVE-2026-61443 was published for praisonaiagents (pip) Oct 8, 2026
anushkavirgaonkar Credited to anushkavirgaonkar
Duplicate Advisory: PraisonAI: SkillTools Executes Scripts Without Path Containment Validation High
GHSA-f352-4x87-wmjh was published for praisonaiagents (pip) Jul 15, 2026 • withdrawn
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution High
CVE-2026-27483 was published for mindsdb (pip) Feb 24, 2026
XlabAITeam Credited to XlabAITeam, keenanwgn, and pkuGenuine keenanwgn keenanwgn
pkuGenuine pkuGenuine
Alist vulnerable to Path Traversal in multiple file operation handlers High
CVE-2026-25161 was published for github.com/alist-org/alist/v3 (Go) Feb 4, 2026
XlabAITeam Credited to XlabAITeam, pkuGenuine, A7um, keenanwgn, and okatu-loli pkuGenuine pkuGenuine
A7um A7um keenanwgn keenanwgn okatu-loli okatu-loli
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine High
CVE-2026-105744 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff, hoanggxyuuki, Smavl, 3m4n5, and Jiayang-Lai hoanggxyuuki hoanggxyuuki
Smavl Smavl 3m4n5 3m4n5 Jiayang-Lai Jiayang-Lai
Payload: Incomplete validation during the upload file lifecycle High
CVE-2026-105865 was published for payload (npm) Oct 7, 2026
EchoSkorJjj Credited to EchoSkorJjj
Ghost: Remote Code Execution via Theme Translation Files High
CVE-2026-105677 was published for ghost (npm) Oct 7, 2026
Alemmi Credited to Alemmi, Tomer-PL, and msegoviag Tomer-PL Tomer-PL
msegoviag msegoviag
Backstage: Improper repository path validation in a Scaffolder backend module High
CVE-2026-106560 was published for @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm) Oct 7, 2026
Backstage has iImproper filesystem validation in Bitbucket pull-request scaffolder actions High
CVE-2026-106486 was published for @backstage/plugin-scaffolder-backend-module-bitbucket-cloud (npm) Oct 7, 2026
Backstage has improper input validation in TechDocs Markdown extension configuration High
CVE-2026-106557 was published for @backstage/plugin-techdocs-node (npm) Oct 7, 2026
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile High
CVE-2026-106103 was published for @quasar/icongenie (npm) Oct 7, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Vibe-Trading file-read tools expose arbitrary server-readable files High
GHSA-5rmq-chc7-m22f was published for vibe-trading-ai (pip) Oct 2, 2026
lemi9090 Credited to lemi9090
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths High
GHSA-8mcx-5rqc-vhmf was published for dulwich (pip) Oct 2, 2026
LukeBanto Credited to LukeBanto and jelmer jelmer jelmer
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence High
GHSA-5fqc-mrg8-w798 was published for dulwich (pip) Oct 2, 2026
manus-use Credited to manus-use and jelmer jelmer jelmer
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks High
GHSA-cm62-gvxx-vmxx was published for dulwich (pip) Oct 2, 2026
manus-use Credited to manus-use and jelmer jelmer jelmer
Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks High
CVE-2026-49119 was published for gradio (pip) Jul 1, 2026
PercevalFox Credited to PercevalFox
Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion High
CVE-2026-47253 was published for github.com/julien040/anyquery (Go) Jun 10, 2026
232-323 Credited to 232-323 and yym8538 yym8538 yym8538
webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath High
CVE-2026-76844 was published for webpack-dev-middleware (npm) Sep 29, 2026
UlisesGascon Credited to UlisesGascon, avivkeller, bjohansebas, and evenstensberg avivkeller avivkeller
bjohansebas bjohansebas evenstensberg evenstensberg
Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath High
GHSA-p3f5-w63m-mxph was published for webpack-dev-middleware (npm) Aug 24, 2026 • withdrawn
Spring Framework Path Traversal vulnerability High
CVE-2024-38819 was published for org.springframework:spring-webflux (Maven) Dec 19, 2024
joshbressers Credited to joshbressers
podman kube play symlink traversal vulnerability High
CVE-2025-9566 was published for github.com/containers/podman/v4 (Go) Sep 4, 2025
Luap99 Credited to Luap99
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem High
GHSA-62mm-xwmv-crhg was published for khoj (pip) Sep 25, 2026
bulmax9797-sketch Credited to bulmax9797-sketch
Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools High
CVE-2026-86439 was published for knowns (npm) Sep 25, 2026
uziii2208 Credited to uziii2208 and hoanggxyuuki hoanggxyuuki hoanggxyuuki
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database