Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

11 advisories

Loading
Dozzle label filters do not restrict container event and statistics streams Moderate
CVE-2026-62286 was published for github.com/amir20/dozzle (Go) Sep 24, 2026
5ud0er Credited to 5ud0er
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for High
CVE-2026-77560 was published for github.com/tinyauthapp/tinyauth (Go) Sep 22, 2026
5ud0er Credited to 5ud0er
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log Moderate
CVE-2026-77425 was published for unleash-server (npm) Sep 22, 2026
5ud0er Credited to 5ud0er
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace Critical
CVE-2026-61682 was published for github.com/kcp-dev/kcp (Go) Sep 18, 2026
5ud0er Credited to 5ud0er
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement High
CVE-2026-61672 was published for github.com/projectcapsule/capsule (Go) Sep 18, 2026
5ud0er Credited to 5ud0er
OpenFGA: ListUsers returns a deliberately-excluded user when a `but not` exclusion under a type-bound wildcard is intersected (`and`) with another relation that also grants that user Moderate
CVE-2026-61709 was published for github.com/openfga/openfga (Go) Sep 16, 2026
5ud0er Credited to 5ud0er
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree Moderate
CVE-2026-63669 was published for apostrophe (npm) Sep 3, 2026
5ud0er Credited to 5ud0er
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers Moderate
CVE-2026-63004 was published for unleash-server (npm) Aug 21, 2026
5ud0er Credited to 5ud0er
rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories High
CVE-2026-59733 was published for github.com/rclone/rclone (Go) Aug 5, 2026
5ud0er Credited to 5ud0er and ncw ncw ncw
OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 Low
CVE-2026-55774 was published for github.com/openbao/openbao (Go) Jun 19, 2026
anir0y Credited to anir0y and 5ud0er 5ud0er 5ud0er
Astro: Host header SSRF in prerendered error page fetch High
CVE-2026-54299 was published for astro (npm) Jun 16, 2026
5ud0er Credited to 5ud0er and cookesan cookesan cookesan
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database