Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

444 advisories

Loading
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions... Low Unreviewed
CVE-2026-111581 was published Oct 16, 2026
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper... Moderate Unreviewed
CVE-2026-111728 was published Oct 16, 2026
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege... High Unreviewed
CVE-2026-104715 was published Oct 16, 2026
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull(... Critical Unreviewed
CVE-2026-110858 was published Oct 15, 2026
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that... High Unreviewed
CVE-2026-110859 was published Oct 15, 2026
Improper neutralization of argument delimiters in a command ('argument injection') in Windows... High Unreviewed
CVE-2026-97798 was published Oct 13, 2026
Potential arbitrary code execution, under specific configurations. Critical Unreviewed
CVE-2026-92892 was published Oct 13, 2026
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows... Moderate Unreviewed
CVE-2026-109966 was published Oct 13, 2026
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g.,... High Unreviewed
CVE-2026-108963 was published Oct 11, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... Low Unreviewed
CVE-2026-11939 was published Oct 8, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... High Unreviewed
CVE-2026-18740 was published Oct 8, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... High Unreviewed
CVE-2026-19482 was published Oct 8, 2026
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection... High Unreviewed
CVE-2026-107639 was published Oct 8, 2026
An authenticated high privilege user can inject arguments in troubleshooting commands resulting... Critical Unreviewed
CVE-2026-107510 was published Oct 8, 2026
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other... High Unreviewed
CVE-2026-93699 was published Oct 8, 2026
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9... High Unreviewed
CVE-2026-87687 was published Oct 8, 2026
An argument injection vulnerability exists in the configuration management command-line utility... High Unreviewed
CVE-2026-87667 was published Oct 8, 2026
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) High
CVE-2026-102827 was published for simple-git (npm) Oct 5, 2026
anir0y Credited to anir0y, bilguunbicktivism, cruzryan, the-vibe-dev, D7EAD, dellalibera, gdegrange, b1ue0ceanRun, Leeziao, internetteletubbie, and arundr0id bilguunbicktivism bilguunbicktivism
cruzryan cruzryan the-vibe-dev the-vibe-dev D7EAD D7EAD dellalibera dellalibera gdegrange gdegrange b1ue0ceanRun b1ue0ceanRun Leeziao Leeziao internetteletubbie internetteletubbie arundr0id arundr0id
Nx: OS command injection via git revisions and remote refs High
GHSA-w2vw-w76x-qr89 was published for nx (npm) Oct 5, 2026
arkmarta Credited to arkmarta
cjbassi/gotop is vulnerable to local argument injection via process termination functionality.... Moderate Unreviewed
CVE-2026-91784 was published Oct 2, 2026
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI... Moderate Unreviewed
CVE-2026-103505 was published Oct 1, 2026
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs Moderate
CVE-2026-102904 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle Moderate
GHSA-whh4-5q6c-9v3x was published for gitpython (pip) Sep 30, 2026
kokomaru167 Credited to kokomaru167
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting:... Critical Unreviewed
CVE-2026-100714 was published Sep 26, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database