Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

9 advisories

Loading
simple-git unsafe-operation guard does not block trailer command configuration Critical
CVE-2026-102828 was published for simple-git (npm) Oct 5, 2026
sec-reex Credited to sec-reex
SiYuan: path traversal via /export/temp/ short-circuit branch (incomplete fix for the export-disclosure hardening, GHSA-6865-qjcf-286f) Moderate
GHSA-gw25-m53r-qh88 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
sec-reex Credited to sec-reex
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` Low
GHSA-wwv5-g3v4-889x was published for tornado (pip) Sep 1, 2026
sec-reex Credited to sec-reex and arpitjain099 arpitjain099 arpitjain099
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925) High
CVE-2026-68519 was published for glances (pip) Aug 17, 2026
sec-reex Credited to sec-reex
Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721) High
CVE-2026-71315 was published for nuxt (npm) Aug 5, 2026
Pig-Tail Credited to Pig-Tail, sec-reex, and DavidCarliez sec-reex sec-reex
DavidCarliez DavidCarliez
Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times` Moderate
CVE-2026-59766 was published for code.gitea.io/gitea (Go) Jul 21, 2026
sec-reex Credited to sec-reex
Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content Moderate
CVE-2026-58440 was published for gitea.dev (Go) Jul 21, 2026
sec-reex Credited to sec-reex
@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped Low
CVE-2026-73425 was published for @astrojs/netlify (npm) Jul 20, 2026
sec-reex Credited to sec-reex and LlewxamDev LlewxamDev LlewxamDev
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies High
CVE-2026-65838 was published for github.com/zalando/skipper (Go) Jul 17, 2026
sec-reex Credited to sec-reex and deepakravisankar deepakravisankar deepakravisankar
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database