Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

468 advisories

Loading
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has... Critical Unreviewed
CVE-2026-76531 was published Oct 22, 2026
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file Moderate
CVE-2026-112948 was published for @vitest/browser (npm) Oct 21, 2026
sondt99 Credited to sondt99, tikket1, and tomohiro86 tikket1 tikket1
tomohiro86 tomohiro86
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows... High Unreviewed
CVE-2026-114400 was published Oct 21, 2026
h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira... Critical Unreviewed
CVE-2026-21589 was published Oct 6, 2026
A vulnerability involving improper access control in the TSplus Remote Access web server that... High Unreviewed
CVE-2026-108070 was published Oct 14, 2026
Files or directories accessible to external parties in Windows Projected File System allows an... Moderate Unreviewed
CVE-2026-96857 was published Oct 13, 2026
Files or directories accessible to external parties in WebDAV allows an authorized attacker to... Moderate Unreviewed
CVE-2026-88137 was published Oct 13, 2026
Files or directories accessible to external parties in Windows Event Viewer allows an authorized... Moderate Unreviewed
CVE-2026-85840 was published Oct 13, 2026
Files or directories accessible to external parties in Windows Bind Filter Driver allows an... Moderate Unreviewed
CVE-2026-85812 was published Oct 13, 2026
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources... Moderate Unreviewed
CVE-2026-89118 was published Oct 13, 2026
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive... Moderate Unreviewed
CVE-2026-94375 was published Oct 10, 2026
Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode Moderate
CVE-2026-105750 was published for docling (pip) Oct 6, 2026
priyankn Credited to priyankn and DavidCarliez DavidCarliez DavidCarliez
SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist) Moderate
GHSA-4wwp-f6gw-6qm5 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 5, 2026
GhostOverflow Credited to GhostOverflow
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker... Moderate Unreviewed
CVE-2026-100727 was published Oct 5, 2026
Vibe-Trading file-read tools expose arbitrary server-readable files High
GHSA-5rmq-chc7-m22f was published for vibe-trading-ai (pip) Oct 2, 2026
lemi9090 Credited to lemi9090
Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation... Moderate Unreviewed
CVE-2026-58415 was published Oct 1, 2026
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables... Critical Unreviewed
CVE-2026-71379 was published Sep 30, 2026
IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls... Moderate Unreviewed
CVE-2026-6544 was published Sep 24, 2026
IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due... Moderate Unreviewed
CVE-2026-15915 was published Sep 23, 2026
NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url... High Unreviewed
CVE-2026-88623 was published Sep 18, 2026
MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials High
CVE-2026-77259 was published for mcp-atlassian (pip) Sep 22, 2026
rushitgit Credited to rushitgit
Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from... High Unreviewed
CVE-2026-77884 was published Sep 14, 2026
The Yogeta WP Cloud WordPress plugin through 1.0 does not validate a user-supplied file path... High Unreviewed
CVE-2026-80494 was published Sep 12, 2026
Files or directories accessible to external parties in Windows Defender Firewall Service allows... Moderate Unreviewed
CVE-2026-68831 was published Sep 8, 2026
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway... Moderate Unreviewed
CVE-2026-75164 was published Sep 4, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database