Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

527 advisories

Loading
Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store... Moderate Unreviewed
CVE-2026-116198 was published Oct 25, 2026
A vulnerability could allow an attacker with access to an encrypted project file to retrieve... Moderate Unreviewed
CVE-2026-43854 was published Oct 20, 2026
AIOHTTP: Secure attribute not enforced for shared cookie Moderate
CVE-2026-111063 was published for aiohttp (pip) Oct 19, 2026
euriconicacio Credited to euriconicacio, Dreamsorcerer, and iamrobertmorrison01-stack Dreamsorcerer Dreamsorcerer
iamrobertmorrison01-stack iamrobertmorrison01-stack
Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of... Moderate Unreviewed
CVE-2026-86375 was published Oct 19, 2026
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of... High Unreviewed
CVE-2026-78860 was published Oct 5, 2026
Applications built on MongoDB Entity Framework Core Provider which combine independent encryption... Moderate Unreviewed
CVE-2026-92756 was published Sep 17, 2026
Applications built on MongoDB Entity Framework Core Provider which place a database name in the... Moderate Unreviewed
CVE-2026-92757 was published Sep 17, 2026
Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job... Moderate Unreviewed
CVE-2026-84676 was published Sep 2, 2026
openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the... High Unreviewed
CVE-2026-81688 was published Aug 27, 2026
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB... Critical Unreviewed
CVE-2026-81681 was published Aug 27, 2026
DJI drones transmit DUML (DJI Universal Markup Language) protocol messages over BLE (Bluetooth... Critical Unreviewed
CVE-2026-77812 was published Aug 21, 2026
CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to encrypt the initramfs contents,... High Unreviewed
CVE-2025-59325 was published Aug 12, 2026
Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent... High Unreviewed
CVE-2026-21079 was published Aug 10, 2026
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion Low
GHSA-464c-974j-9xm6 was published for @aws-cdk/aws-codebuild (Go) Jul 24, 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS... High Unreviewed
CVE-2026-20157 was published Jul 15, 2026
CoreWCF: SPNEGO SecurityContextToken proof key wrapped without confidentiality High
CVE-2026-54784 was published for CoreWCF.Primitives (NuGet) Jun 19, 2026
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext Moderate
CVE-2026-55568 was published for guzzlehttp/guzzle (Composer) Jun 19, 2026
GrahamCampbell Credited to GrahamCampbell
Jenkins does not encrypt secrets from POST config.xml submissions before storing them in job configurations Moderate
CVE-2026-53442 was published for org.jenkins-ci.main:jenkins-core (Maven) Jun 10, 2026
Apache Tomcat Missing Encryption of Sensitive Data vulnerability High
CVE-2026-34486 was published for org.apache.tomcat:tomcat (Maven) Apr 9, 2026
tkwilli94 Credited to tkwilli94
Antrea has Missing Encryption of Sensitive Data High
CVE-2026-34992 was published for antrea.io/antrea (Go) Apr 3, 2026
antoninbas Credited to antoninbas and xliuxu xliuxu xliuxu
Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure Critical
CVE-2026-27944 was published for github.com/0xJacky/Nginx-UI (Go) Mar 5, 2026
tenbbughunters Credited to tenbbughunters
Rancher's weave CNI password is not configured when a cluster is created from an RKE template Moderate
CVE-2022-21951 was published for github.com/rancher/rancher (Go) Mar 3, 2026
Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due... Moderate Unreviewed
CVE-2025-15548 was published Jan 29, 2026
A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with... High Unreviewed
CVE-2025-13453 was published Jan 15, 2026
Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X.... Critical Unreviewed
CVE-2025-36751 was published Dec 13, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database