Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

63 advisories

Loading
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that... Low Unreviewed
CVE-2026-65655 was published Aug 11, 2026
IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization... Moderate Unreviewed
CVE-2026-15656 was published Aug 5, 2026
HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of... Low Unreviewed
CVE-2026-56581 was published Jul 21, 2026
HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which... Moderate Unreviewed
CVE-2024-23572 was published Jul 17, 2026
Pinpoint through version 3.1.0 contains an insecure session management vulnerability that allows... High Unreviewed
CVE-2026-57948 was published Jun 29, 2026
A vulnerability was determined in TwiN gatus 5.36.0. Impacted is the function setSessionCookie of... Moderate Unreviewed
CVE-2026-11956 was published Jun 11, 2026
nebula-mesh: Session and OIDC state cookies lack the Secure attribute Moderate
CVE-2026-48058 was published for github.com/juev/nebula-mesh (Go) Jun 10, 2026
ak2k Credited to ak2k
HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the... Low Unreviewed
CVE-2025-52608 was published Jun 4, 2026
Apache Airflow has a Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Moderate
CVE-2026-41017 was published for apache-airflow (pip) Jun 1, 2026
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute Moderate
CVE-2026-43828 was published for org.apache.shiro:shiro-web (Maven) May 26, 2026
NocoDB: Refresh Token Cookie Set Without `secure` and `sameSite` Flags Moderate
CVE-2026-46550 was published for nocodb (npm) May 21, 2026
ik0z Credited to ik0z
Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow... Moderate Unreviewed
CVE-2026-22617 was published Apr 16, 2026
IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on... Moderate Unreviewed
CVE-2026-4820 was published Apr 1, 2026
@grackle-ai/server has a Missing Secure Flag on Session Cookie Low
GHSA-5j35-xr4g-vwf4 was published for @grackle-ai/server (npm) Mar 25, 2026
In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure... Moderate Unreviewed
CVE-2026-32745 was published Mar 13, 2026
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web... Moderate Unreviewed
CVE-2026-1697 was published Feb 26, 2026
A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL... Moderate Unreviewed
CVE-2024-58317 was published Dec 18, 2025
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on... Low Unreviewed
CVE-2025-36249 was published Oct 31, 2025
HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious... Low Unreviewed
CVE-2025-52614 was published Oct 12, 2025
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue... Moderate Unreviewed
CVE-2025-52632 was published Oct 10, 2025
IBM Jazz for Service Management 1.1.3.0 through 1.1.3.24 does not set the secure attribute on... Moderate Unreviewed
CVE-2025-36011 was published Sep 9, 2025
Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the... Critical Unreviewed
CVE-2025-8037 was published Jul 22, 2025
This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure... High Unreviewed
CVE-2025-53757 was published Jul 16, 2025
The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker... Moderate Unreviewed
CVE-2025-27450 was published Jul 3, 2025
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens... Moderate Unreviewed
CVE-2025-36026 was published Jun 28, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database