Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

341 advisories

Loading
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of... Moderate Unreviewed
CVE-2026-103301 was published Oct 21, 2026
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment... Moderate Unreviewed
CVE-2026-104641 was published Oct 21, 2026
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that... Moderate Unreviewed
CVE-2026-105256 was published Oct 21, 2026
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a... Moderate Unreviewed
CVE-2026-86791 was published Oct 19, 2026
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its... Moderate Unreviewed
CVE-2026-74922 was published Oct 19, 2026
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not... Moderate Unreviewed
CVE-2026-103311 was published Oct 19, 2026
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key,... Moderate Unreviewed
CVE-2026-111392 was published Oct 16, 2026
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation Moderate
CVE-2026-102682 was published for pipecat-ai (pip) Oct 15, 2026
infycore Credited to infycore and agent-kira agent-kira agent-kira
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a... Moderate Unreviewed
CVE-2026-92429 was published Oct 15, 2026
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a... Moderate Unreviewed
CVE-2026-92428 was published Oct 15, 2026
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly... Moderate Unreviewed
CVE-2026-103324 was published Oct 15, 2026
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was... Moderate Unreviewed
CVE-2026-82844 was published Oct 14, 2026
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming... Moderate Unreviewed
CVE-2026-88998 was published Oct 14, 2026
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of... Moderate Unreviewed
CVE-2026-103308 was published Oct 14, 2026
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is... Moderate Unreviewed
CVE-2026-108069 was published Oct 14, 2026
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check... Moderate Unreviewed
CVE-2026-107160 was published Oct 14, 2026
Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows... Moderate Unreviewed
CVE-2026-109365 was published Oct 12, 2026
Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency... Moderate Unreviewed
CVE-2026-107420 was published Oct 10, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0... Moderate Unreviewed
CVE-2026-13257 was published Oct 8, 2026
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an... Moderate Unreviewed
CVE-2026-103517 was published Oct 8, 2026
Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME... Moderate Unreviewed
CVE-2026-105818 was published Oct 8, 2026
Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in... Moderate Unreviewed
CVE-2026-59357 was published Oct 6, 2026
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion Moderate
CVE-2026-102275 was published for PyJWT (pip) Oct 5, 2026
ze3tar Credited to ze3tar
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an... Moderate Unreviewed
CVE-2026-105161 was published Oct 4, 2026
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks... Moderate Unreviewed
CVE-2026-104419 was published Oct 2, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database