Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

263 advisories

Loading
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For Moderate
CVE-2026-114437 was published for github.com/go-chi/chi/v5 (Go) Oct 23, 2026
tenbbughunters Credited to tenbbughunters
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine Moderate
CVE-2026-114050 was published for vllm (pip) Oct 23, 2026
C1ves Credited to C1ves, JSGforever, and jperezdealgaba JSGforever JSGforever
jperezdealgaba jperezdealgaba
Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization High
GHSA-hfwf-hgvp-4rr8 was published for vllm (pip) Oct 21, 2026 • withdrawn
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin Moderate
CVE-2026-62204 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 23, 2026
alham-rizvi Credited to alham-rizvi
Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin Moderate
GHSA-989h-w3q9-3m2f was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 22, 2026 • withdrawn
json-web-token library is vulnerable to a JWT algorithm confusion attack High
CVE-2023-48238 was published for json-web-token (npm) Nov 17, 2023
PinkDraconian Credited to PinkDraconian and nikpivkin nikpivkin nikpivkin
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) Low
CVE-2026-76894 was published for @aborruso/ckan-mcp-server (npm) Oct 16, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation Moderate
CVE-2026-102682 was published for pipecat-ai (pip) Oct 15, 2026
infycore Credited to infycore and agent-kira agent-kira agent-kira
OmniFaces: Forged combined-resource IDs and related output/push boundaries High
CVE-2026-102695 was published for org.omnifaces:omnifaces (Maven) Jul 24, 2026
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover High
CVE-2026-62367 was published for code.vikunja.io/api (Go) Oct 9, 2026
maskop9 Credited to maskop9 and evilgensec evilgensec evilgensec
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write High
CVE-2026-105741 was published for langflow (pip) Oct 7, 2026
erichare Credited to erichare and andifilhohub andifilhohub andifilhohub
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing High
CVE-2026-61428 was published for praisonai (pip) Oct 7, 2026
dinhvaren Credited to dinhvaren
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server High
CVE-2026-104850 was published for @modelcontextprotocol/client (npm) Oct 6, 2026
Aviral2642 Credited to Aviral2642, AlexMelanFromRingo, Gal3m, JosephDoUrden, Igfray, OriginalKazdov, and lwebmedia AlexMelanFromRingo AlexMelanFromRingo
Gal3m Gal3m JosephDoUrden JosephDoUrden Igfray Igfray OriginalKazdov OriginalKazdov lwebmedia lwebmedia
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion Moderate
CVE-2026-102275 was published for PyJWT (pip) Oct 5, 2026
ze3tar Credited to ze3tar
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard High
CVE-2026-102831 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
PyJWT: PyJWKClient follows redirects when fetching JWKS High
CVE-2026-102267 was published for PyJWT (pip) Sep 29, 2026
NovaHunter06 Credited to NovaHunter06
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag Critical
GHSA-wfqx-gjrf-g28r was published for github.com/crossplane/crossplane (Go) Jun 19, 2026
bugbunny-research Credited to bugbunny-research, tonghuaroot, and adamwg tonghuaroot tonghuaroot
adamwg adamwg
undici vulnerable to caching and replay of unsafe HTTP method responses Low
CVE-2026-85008 was published for undici (npm) Sep 29, 2026
MegaManSec Credited to MegaManSec, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer High
CVE-2026-102677 was published for electron (npm) Sep 29, 2026
varisys Credited to varisys
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider Critical
CVE-2026-92161 was published for fof/oauth (Composer) Sep 25, 2026
faran1512 Credited to faran1512
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper High
CVE-2025-71370 was published for picklescan (pip) Aug 22, 2025
FredericDT Credited to FredericDT
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body Moderate
CVE-2026-63405 was published for github.com/anycable/anycable (Go) Sep 18, 2026
de3erve-hunter Credited to de3erve-hunter
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records High
CVE-2026-45674 was published for io.netty:netty-resolver-dns (Maven) Jun 8, 2026
violetagg Credited to violetagg
Netty has Insufficient Bailiwick Validation for NS Records High
CVE-2026-47691 was published for io.netty:netty-resolver-dns (Maven) Jun 8, 2026
violetagg Credited to violetagg
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses High
CVE-2026-86039 was published for @libp2p/peer-store (npm) Sep 17, 2026
Alleysira Credited to Alleysira
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database