Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

114 advisories

Loading
Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization High
GHSA-hfwf-hgvp-4rr8 was published for vllm (pip) Oct 21, 2026 • withdrawn
json-web-token library is vulnerable to a JWT algorithm confusion attack High
CVE-2023-48238 was published for json-web-token (npm) Nov 17, 2023
PinkDraconian Credited to PinkDraconian and nikpivkin nikpivkin nikpivkin
OmniFaces: Forged combined-resource IDs and related output/push boundaries High
CVE-2026-102695 was published for org.omnifaces:omnifaces (Maven) Jul 24, 2026
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover High
CVE-2026-62367 was published for code.vikunja.io/api (Go) Oct 9, 2026
maskop9 Credited to maskop9 and evilgensec evilgensec evilgensec
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write High
CVE-2026-105741 was published for langflow (pip) Oct 7, 2026
erichare Credited to erichare and andifilhohub andifilhohub andifilhohub
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing High
CVE-2026-61428 was published for praisonai (pip) Oct 7, 2026
dinhvaren Credited to dinhvaren
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server High
CVE-2026-104850 was published for @modelcontextprotocol/client (npm) Oct 6, 2026
Aviral2642 Credited to Aviral2642, AlexMelanFromRingo, Gal3m, JosephDoUrden, Igfray, OriginalKazdov, and lwebmedia AlexMelanFromRingo AlexMelanFromRingo
Gal3m Gal3m JosephDoUrden JosephDoUrden Igfray Igfray OriginalKazdov OriginalKazdov lwebmedia lwebmedia
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard High
CVE-2026-102831 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
PyJWT: PyJWKClient follows redirects when fetching JWKS High
CVE-2026-102267 was published for PyJWT (pip) Sep 29, 2026
NovaHunter06 Credited to NovaHunter06
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer High
CVE-2026-102677 was published for electron (npm) Sep 29, 2026
varisys Credited to varisys
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper High
CVE-2025-71370 was published for picklescan (pip) Aug 22, 2025
FredericDT Credited to FredericDT
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records High
CVE-2026-45674 was published for io.netty:netty-resolver-dns (Maven) Jun 8, 2026
violetagg Credited to violetagg
Netty has Insufficient Bailiwick Validation for NS Records High
CVE-2026-47691 was published for io.netty:netty-resolver-dns (Maven) Jun 8, 2026
violetagg Credited to violetagg
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses High
CVE-2026-86039 was published for @libp2p/peer-store (npm) Sep 17, 2026
Alleysira Credited to Alleysira
libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID High
CVE-2026-86038 was published for @libp2p/gossipsub (npm) Sep 17, 2026
Alleysira Credited to Alleysira
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery High
CVE-2026-63127 was published for rmcp (Rust) Sep 16, 2026
djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) High
CVE-2026-61591 was published for djust (pip) Sep 16, 2026
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config High
CVE-2025-71348 was published for picklescan (pip) Aug 22, 2025
FredericDT Credited to FredericDT
Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check High
GHSA-mf7q-r4rv-jv94 was published for github.com/crossplane/crossplane-runtime/v2 (Go) Aug 27, 2026
tonghuaroot Credited to tonghuaroot and bugbunny-research bugbunny-research bugbunny-research
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header High
CVE-2026-54167 was published for github.com/openshift-pipelines/pipelines-as-code (Go) Aug 20, 2026
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage High
CVE-2026-53728 was published for @medplum/core (npm) Aug 17, 2026
sAjibuu Credited to sAjibuu
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth High
CVE-2026-54763 was published for github.com/traefik/traefik/v2 (Go) Aug 6, 2026
matte1782 Credited to matte1782
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning High
CVE-2026-68945 was published for @angular/common (npm) Aug 3, 2026
Hexix23 Credited to Hexix23, alan-agius4, and JeanMeche alan-agius4 alan-agius4
JeanMeche JeanMeche
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF) High
GHSA-pvcr-8mvp-w8qr was published for @budibase/server (npm) Jul 24, 2026
hypnguyen1209 Credited to hypnguyen1209
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in High
GHSA-qq9h-g4jm-xgf3 was published for better-auth (npm) Jul 24, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database