Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

95 advisories

Loading
A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect... Critical Unreviewed
CVE-2026-66785 was published Aug 20, 2026
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches... Critical Unreviewed
CVE-2026-16516 was published Oct 7, 2026
This vulnerability exists in the ERP system due to improper validation of payment callback... Critical Unreviewed
CVE-2026-107102 was published Oct 7, 2026
Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached... Critical Unreviewed
CVE-2026-104056 was published Oct 1, 2026
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as... Critical Unreviewed
CVE-2026-89238 was published Sep 30, 2026
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag Critical
GHSA-wfqx-gjrf-g28r was published for github.com/crossplane/crossplane (Go) Jun 19, 2026
bugbunny-research Credited to bugbunny-research, tonghuaroot, and adamwg tonghuaroot tonghuaroot
adamwg adamwg
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider Critical
CVE-2026-92161 was published for fof/oauth (Composer) Sep 25, 2026
faran1512 Credited to faran1512
The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware... Critical Unreviewed
CVE-2026-81630 was published Sep 24, 2026
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code... Critical Unreviewed
CVE-2026-28324 was published Sep 22, 2026
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker... Critical Unreviewed
CVE-2026-62874 was published Sep 18, 2026
kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file... Critical Unreviewed
CVE-2026-88592 was published Sep 16, 2026
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... Critical Unreviewed
CVE-2026-80172 was published Sep 9, 2026
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating... Critical Unreviewed
CVE-2026-85434 was published Sep 4, 2026
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on... Critical Unreviewed
CVE-2026-85435 was published Sep 4, 2026
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient... Critical Unreviewed
CVE-2026-82858 was published Aug 31, 2026
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build... Critical Unreviewed
CVE-2026-19410 was published Aug 31, 2026
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities... Critical Unreviewed
CVE-2026-81702 was published Aug 27, 2026
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and... Critical Unreviewed
CVE-2026-81706 was published Aug 27, 2026
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in... Critical Unreviewed
CVE-2026-74890 was published Aug 17, 2026
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema... Critical Unreviewed
CVE-2026-74875 was published Aug 17, 2026
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. Critical Unreviewed
CVE-2026-28185 was published Aug 13, 2026
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without... Critical Unreviewed
CVE-2026-65583 was published Aug 6, 2026
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the... Critical Unreviewed
CVE-2026-63687 was published Aug 6, 2026
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling... Critical Unreviewed
CVE-2026-15612 was published Jul 23, 2026
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints Critical
CVE-2026-53513 was published for @better-auth/sso (npm) Jul 7, 2026
vaadata-poyetont Credited to vaadata-poyetont
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database