Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

468 advisories

Loading
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references Low
CVE-2026-110725 was published for fast-uri (npm) Oct 23, 2026
UlisesGascon Credited to UlisesGascon and mcollina mcollina mcollina
MongoDB Compass improperly escapes certain BSON values when converting a stored view’s... High Unreviewed
CVE-2026-113870 was published Oct 21, 2026
Vitest: Code injection via unauthenticated manual mock registration Moderate
CVE-2026-112949 was published for @vitest/mocker (npm) Oct 21, 2026
sondt99 Credited to sondt99
virtualenv bash activate runs commands from an environment name with a backslash before $ High
CVE-2026-113725 was published for virtualenv (pip) Oct 21, 2026
gaborbernat Credited to gaborbernat
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST High
CVE-2026-113726 was published for virtualenv (pip) Oct 21, 2026
kemrec Credited to kemrec and gaborbernat gaborbernat gaborbernat
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote High
CVE-2026-113732 was published for virtualenv (pip) Oct 21, 2026
Kwstubbs Credited to Kwstubbs and gaborbernat gaborbernat gaborbernat
The HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled... Moderate Unreviewed
CVE-2026-14556 was published Oct 21, 2026
ApostropheCMS: CAPTCHA response token not URL-encoded Moderate
CVE-2026-113667 was published for @apostrophecms/form (npm) Oct 20, 2026
chaitanyaeshwarprasad Credited to chaitanyaeshwarprasad
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML Moderate
CVE-2026-111059 was published for mercury (pip) Oct 19, 2026
yuuto200511-hash Credited to yuuto200511-hash
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a... Critical Unreviewed
CVE-2026-110756 was published Oct 17, 2026
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as... Critical Unreviewed
CVE-2026-110757 was published Oct 17, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint Low
CVE-2026-54893 was published for swoosh (Erlang) Oct 16, 2026
PJUllrich Credited to PJUllrich, maennchen, and princemaple maennchen maennchen
princemaple princemaple
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote... Critical Unreviewed
CVE-2026-18516 was published Oct 16, 2026
Vitess vttablet /twopcz reflected XSS Critical
CVE-2026-104252 was published for vitess.io/vitess (Go) Oct 15, 2026
xylove21 Credited to xylove21
unstructured: Stored XSS via unescaped HTML generation Moderate
CVE-2026-104250 was published for unstructured (pip) Oct 15, 2026
hayato1121 Credited to hayato1121
BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template... Moderate Unreviewed
CVE-2026-110592 was published Oct 14, 2026
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to... High Unreviewed
CVE-2026-102235 was published Oct 13, 2026
Contao: Cross-site scripting in the comments bundle Critical
CVE-2026-107845 was published for contao/comments-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source High
CVE-2026-61433 was published for praisonai (pip) Oct 8, 2026
rexpository Credited to rexpository
Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates Moderate
CVE-2026-106444 was published for handlebars (npm) Oct 8, 2026
amwhoi Credited to amwhoi
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats High
CVE-2026-61439 was published for PraisonAI (pip) Oct 7, 2026
chakrapani150 Credited to chakrapani150
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained High
CVE-2026-106107 was published for @quasar/app-vite (npm) Oct 7, 2026
hawkeye64 Credited to hawkeye64
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() Critical
CVE-2026-106102 was published for quasar (npm) Oct 7, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache... Moderate Unreviewed
CVE-2026-105244 was published Oct 6, 2026
openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation High
CVE-2026-105801 was published for openapi-python-client (pip) Oct 6, 2026
Gal3m Credited to Gal3m, iabdullah215, and 0xsharz iabdullah215 iabdullah215
0xsharz 0xsharz
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database