Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

70 advisories

Loading
Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens... Critical Unreviewed
CVE-2026-97468 was published Oct 9, 2026
NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, where an attacker... High Unreviewed
CVE-2026-65104 was published Oct 13, 2026
An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary... Critical Unreviewed
CVE-2026-51996 was published Sep 24, 2026
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to... Moderate Unreviewed
CVE-2026-97469 was published Sep 25, 2026
Flowise has Insufficient Password Salt Rounds Moderate
CVE-2026-56272 was published for flowise (npm) Mar 5, 2026
kolega-ai-dev Credited to kolega-ai-dev
@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning High
CVE-2026-54266 was published for @angular/common (npm) Jun 15, 2026
alan-agius4 Credited to alan-agius4, JeanMeche, and josephperrott JeanMeche JeanMeche
josephperrott josephperrott
R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an... High Unreviewed
CVE-2026-41879 was published Jul 10, 2026
The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords,... Moderate Unreviewed
CVE-2026-10540 was published Jul 1, 2026
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to... Moderate Unreviewed
CVE-2026-13455 was published Jun 30, 2026
Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store user passwords. Because... Moderate Unreviewed
CVE-2026-53692 was published Jun 30, 2026
phpMyFAQ has Weak Cryptography - SHA1 for Password Hashing Low
CVE-2026-48488 was published for phpmyfaq/phpmyfaq (Composer) Jun 23, 2026
N0tFix3d Credited to N0tFix3d
motionEye: Authentication possible via password hash Critical
CVE-2026-46488 was published for motioneye (pip) Jun 22, 2026
FireByteApplications Credited to FireByteApplications, 0xLynk, dimashn04, C4spr0x1A, sighnwaive, MichaIng, Marijn0, and zagrim 0xLynk 0xLynk
dimashn04 dimashn04 C4spr0x1A C4spr0x1A sighnwaive sighnwaive MichaIng MichaIng Marijn0 Marijn0 zagrim zagrim
GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password,... Critical Unreviewed
CVE-2026-36182 was published Jun 4, 2026
The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context... Moderate Unreviewed
CVE-2004-2761 was published Apr 29, 2022
Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting Low
CVE-2026-44582 was published for next (npm) May 11, 2026
Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows... Critical Unreviewed
CVE-2020-37168 was published May 13, 2026
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4... Moderate Unreviewed
CVE-2025-3576 was published Apr 15, 2025
A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric... Moderate Unreviewed
CVE-2026-21717 was published Mar 30, 2026
Plonky3: The sponge construction used to get a hash function from a cryptographic permutation is not collision resistant for inputs of different lengths Low
GHSA-3g92-f9ch-qjcm was published for p3-symmetric (Rust) Apr 16, 2026
Poseidon V1 variable-length input collision via implicit zero-padding High
CVE-2026-32129 was published for soroban-poseidon (Rust) Mar 13, 2026
An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi... Moderate Unreviewed
CVE-2025-41762 was published Mar 9, 2026
OpenClaw replaced a deprecated sandbox hash algorithm High
CVE-2026-28479 was published for openclaw (npm) Feb 19, 2026
kexinoh Credited to kexinoh
@keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script High
GHSA-8986-v76q-8vr2 was published for @keep-network/tbtc-v2 (npm) Mar 2, 2026
SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 use the cryptographically broken MD5... Moderate Unreviewed
CVE-2026-27754 was published Feb 27, 2026
Mattermost Server uses weak hashing for OAuth, email verification tokens and invitations High
CVE-2017-18917 was published for github.com/mattermost/mattermost-server (Go) May 24, 2022
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database