GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
4 advisories
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
High
CVE-2026-102827
was published
for
simple-git
(npm)
Oct 5, 2026
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects
Moderate
CVE-2026-104183
was published
for
stream-json
(npm)
Oct 5, 2026
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
Moderate
CVE-2026-101910
was published
for
ip-address
(npm)
Sep 28, 2026
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Critical
CVE-2026-73649
was published
for
velocityjs
(npm)
Jul 24, 2026
ProTip!
Advisories are also available from the
GraphQL API