Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

27 advisories

Loading
Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers... Unknown Unreviewed
CVE-2026-94140 was published Oct 22, 2026
Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect... Unknown Unreviewed
CVE-2026-94423 was published Oct 22, 2026
The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, ... Moderate Unreviewed
CVE-2026-94135 was published Oct 16, 2026
The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless ... Critical Unreviewed
CVE-2026-94134 was published Oct 16, 2026
FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based... Moderate Unreviewed
CVE-2026-107675 was published Oct 8, 2026
Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine... Moderate Unreviewed
CVE-2026-77703 was published Sep 24, 2026
Central Dogma: SSH host-key verification permanently disabled in Git mirror (SshGitMirror) High
CVE-2026-11745 was published for com.linecorp.centraldogma:centraldogma-server-mirror-git (Maven) Sep 11, 2026
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands Moderate
CVE-2026-18654 was published for awscli (pip) Aug 6, 2026
The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no`... High Unreviewed
CVE-2026-58065 was published Jul 13, 2026
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default High
CVE-2026-45361 was published for apache-airflow-providers-google (pip) May 26, 2026
goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled HTTP request High
GHSA-mxg3-432p-mr72 was published for goshs.de/goshs/v2 (Go) May 15, 2026
offset Credited to offset
Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device... Moderate Unreviewed
CVE-2026-1354 was published Apr 22, 2026
A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper... High Unreviewed
CVE-2025-13914 was published Apr 10, 2026
Duplicate Advisory: Keylime Missing Authentication for Critical Function and Improper Authentication Critical
GHSA-27jc-jmp8-qfw5 was published for keylime (pip) Feb 6, 2026 • withdrawn
SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows... High Unreviewed
CVE-2025-62501 was published Feb 3, 2026
curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was... Moderate Unreviewed
CVE-2025-10966 was published Nov 7, 2025
A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could... High Unreviewed
CVE-2025-20163 was published Jun 4, 2025
Backup uploads to ETM subject to man-in-the-middle interception High Unreviewed
CVE-2024-47519 was published Jan 11, 2025
A vulnerability in Brocade Fabric OS versions before 9.2.2 could allow man-in-the-middle... High Unreviewed
CVE-2024-7516 was published Nov 12, 2024
Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and... Moderate Unreviewed
CVE-2024-6572 was published Sep 9, 2024
A vulnerability was found in Satellite. When running a remote execution job on a host, the host's... Moderate Unreviewed
CVE-2024-4871 was published May 14, 2024
When matrix-nio receives forwarded room keys, the receiver doesn't check if it requested the key from the forwarder High
CVE-2022-39254 was published for matrix-nio (pip) Sep 30, 2022
matrix-js-sdk subject to user impersonation due to key/device identifier confusion in SAS verification High
CVE-2022-39250 was published for matrix-js-sdk (npm) Sep 30, 2022
matrix-android-sdk2 vulnerable to Olm/Megolm protocol confusion High
CVE-2022-39248 was published for org.matrix.android:matrix-android-sdk2 (Maven) Sep 30, 2022
matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions High
CVE-2022-39246 was published for org.matrix.android:matrix-android-sdk2 (Maven) Sep 30, 2022
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database