Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

150 advisories

Loading
Laravel TokenGuard authentication bypass through non-string API credentials Critical
CVE-2026-114509 was published for laravel/framework (Composer) Oct 23, 2026
KIKOmanasijev Credited to KIKOmanasijev
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete... Moderate Unreviewed
CVE-2026-90458 was published Oct 23, 2026
Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation... Moderate Unreviewed
CVE-2026-115383 was published Oct 22, 2026
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to... High Unreviewed
CVE-2026-110857 was published Oct 15, 2026
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker... High Unreviewed
CVE-2026-97801 was published Oct 13, 2026
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate... High Unreviewed
CVE-2026-96044 was published Oct 13, 2026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... Low Unreviewed
CVE-2026-78016 was published Oct 9, 2026
fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array High
CVE-2026-107723 was published for fast-jwt (npm) Oct 8, 2026
rtvkiz Credited to rtvkiz
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats High
CVE-2026-61439 was published for PraisonAI (pip) Oct 7, 2026
chakrapani150 Credited to chakrapani150
SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ... Moderate Unreviewed
CVE-2026-94570 was published Sep 22, 2026
Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking... Low Unreviewed
CVE-2026-75588 was published Sep 17, 2026
A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776... Moderate Unreviewed
CVE-2026-89207 was published Sep 16, 2026
Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value Moderate
CVE-2026-87012 was published for open-webui (pip) Sep 10, 2026
DshtAnger Credited to DshtAnger and Classic298 Classic298 Classic298
Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non... High Unreviewed
CVE-2026-86287 was published Sep 7, 2026
github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar... Moderate Unreviewed
CVE-2026-80051 was published Aug 25, 2026
An ACAP configuration file lacks input validation, which could potentially lead to privilege... Moderate Unreviewed
CVE-2026-5304 was published Aug 11, 2026
Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated... High Unreviewed
CVE-2026-18830 was published Aug 4, 2026
In geniezone, there is a possible escalation of privilege due to a missing permission check. This... Moderate Unreviewed
CVE-2026-20498 was published Aug 3, 2026
Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM... High Unreviewed
CVE-2026-4773 was published Jul 22, 2026
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability High
CVE-2026-50524 was published for Microsoft.NetCore.App.Runtime.linux-arm (NuGet) Jul 20, 2026
YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read Moderate
CVE-2026-52763 was published for yeswiki/yeswiki (Composer) Jul 9, 2026
CosmicCrusader23 Credited to CosmicCrusader23
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions High
CVE-2026-2092 was published for org.keycloak:keycloak-services (Maven) Jul 2, 2026
1seal Credited to 1seal
vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels Moderate
CVE-2026-54235 was published for vllm (pip) Jun 17, 2026
brodmart Credited to brodmart and jperezdealgaba jperezdealgaba jperezdealgaba
A denial-of-service vulnerability exists in the WebSocket API due to insufficient validation and... High Unreviewed
CVE-2026-10825 was published Jun 16, 2026
The $_internalApplyOplogUpdate aggregation pipeline stage can be used to execute a document diff... High Unreviewed
CVE-2026-9753 was published Jun 10, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database