Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

211 advisories

Loading
A vulnerability in the web-based Cisco IOx application hosting environment management interface... Moderate Unreviewed
CVE-2026-20113 was published Mar 25, 2026
iCalendar has ICS injection via unsanitized URI property values Moderate
CVE-2026-33635 was published for icalendar (RubyGems) Mar 24, 2026
WesR Credited to WesR
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to... Moderate Unreviewed
CVE-2026-28753 was published Mar 24, 2026
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields High
CVE-2026-33128 was published for h3 (npm) Mar 18, 2026
0xkakash1 Credited to 0xkakash1
A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type... Low Unreviewed
CVE-2026-3634 was published Mar 17, 2026
A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the ... Low Unreviewed
CVE-2026-3633 was published Mar 17, 2026
Undici has CRLF Injection in undici via `upgrade` option Moderate
CVE-2026-1527 was published for undici (npm) Mar 13, 2026
mcollina Credited to mcollina and UlisesGascon UlisesGascon UlisesGascon
A flaw was found in mod_proxy_cluster. This vulnerability, a Carriage Return Line Feed (CRLF)... Moderate Unreviewed
CVE-2026-3234 was published Mar 12, 2026
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.11 before 18.7.6, 18... Moderate Unreviewed
CVE-2026-3848 was published Mar 11, 2026
MimeKit has CRLF Injection in Quoted Local-Part that Enables SMTP Command Injection and Email Forgery Moderate
CVE-2026-30227 was published for MimeKit (NuGet) Mar 5, 2026
KC1zs4 Credited to KC1zs4
A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation... Moderate Unreviewed
CVE-2026-28296 was published Feb 26, 2026
The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution... High Unreviewed
CVE-2026-1714 was published Feb 18, 2026
A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition... Moderate Unreviewed
CVE-2026-1536 was published Jan 28, 2026
A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage... Moderate Unreviewed
CVE-2026-1467 was published Jan 27, 2026
Gakido vulnerable to HTTP Header Injection (CRLF Injection) Moderate
CVE-2026-24489 was published for gakido (pip) Jan 26, 2026
omarkurt Credited to omarkurt
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for... Moderate Unreviewed
CVE-2026-1299 was published Jan 23, 2026
Incus container environment configuration newline injection High
CVE-2026-23953 was published for github.com/lxc/incus/v6 (Go) Jan 22, 2026
rmcnamara-snyk Credited to rmcnamara-snyk and stgraber stgraber stgraber
When folding a long comment in an email header containing exclusively unfoldable characters, the... Moderate Unreviewed
CVE-2025-11468 was published Jan 21, 2026
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through... Moderate Unreviewed
CVE-2025-15282 was published Jan 21, 2026
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting... Moderate Unreviewed
CVE-2026-0672 was published Jan 21, 2026
Mailpit has an SMTP Header Injection via Regex Bypass Moderate
CVE-2026-23829 was published for github.com/axllent/mailpit (Go) Jan 20, 2026
omarkurt Credited to omarkurt
BlackSheep's ClientSession is vulnerable to CRLF injection Moderate
CVE-2026-22779 was published for blacksheep (pip) Jan 14, 2026
tr4ce-ju Credited to tr4ce-ju
ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler High
CVE-2026-22777 was published for comfy-cli (pip) Jan 13, 2026
A CRLF injection vulnerability in Kentico Xperience allows attackers to manipulate URL query... Moderate Unreviewed
CVE-2022-50682 was published Dec 18, 2025
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Moderate
CVE-2025-67735 was published for io.netty:netty-codec-http (Maven) Dec 15, 2025
vietj Credited to vietj and nakyamad nakyamad nakyamad
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database