Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

3,537 advisories

Loading
A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function... Moderate Unreviewed
CVE-2026-116056 was published Oct 25, 2026
YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that... Moderate Unreviewed
CVE-2026-116205 was published Oct 25, 2026
rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows... High Unreviewed
CVE-2026-116192 was published Oct 25, 2026
phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export... Moderate Unreviewed
CVE-2026-116182 was published Oct 25, 2026
vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows... High Unreviewed
CVE-2026-116176 was published Oct 25, 2026
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright... High Unreviewed
CVE-2026-116066 was published Oct 25, 2026
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that... Moderate Unreviewed
CVE-2026-116069 was published Oct 25, 2026
A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects... Moderate Unreviewed
CVE-2026-116000 was published Oct 25, 2026
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints Moderate
CVE-2026-115886 was published for mlflow (pip) Oct 23, 2026
adamyordan Credited to adamyordan
Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle... Moderate Unreviewed
CVE-2026-115810 was published Oct 23, 2026
Server-side request forgery in the model download path in Amazon Web Services Multi Model Server... Moderate Unreviewed
CVE-2026-115813 was published Oct 23, 2026
@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that... High Unreviewed
CVE-2026-115729 was published Oct 23, 2026
Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery... Low Unreviewed
CVE-2026-115752 was published Oct 23, 2026
A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version... High Unreviewed
CVE-2026-19678 was published Oct 23, 2026
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate... High Unreviewed
CVE-2026-108456 was published Oct 23, 2026
crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler... Moderate Unreviewed
CVE-2026-115411 was published Oct 22, 2026
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side... High Unreviewed
CVE-2026-114730 was published Oct 22, 2026
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows... Low Unreviewed
CVE-2026-87953 was published Oct 22, 2026
WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in... Moderate Unreviewed
CVE-2026-114634 was published Oct 22, 2026
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the... Moderate Unreviewed
CVE-2026-114362 was published Oct 21, 2026
A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown... Low Unreviewed
CVE-2026-114374 was published Oct 21, 2026
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs Moderate
CVE-2026-62197 was published for openclaw (npm) Oct 21, 2026
jason-allen-oneal Credited to jason-allen-oneal
NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This... High Unreviewed
CVE-2026-92210 was published Oct 21, 2026
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information... High Unreviewed
CVE-2026-92204 was published Oct 21, 2026
Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information... High Unreviewed
CVE-2026-92203 was published Oct 21, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database