GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
8 advisories
YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters
High
CVE-2026-52770
was published
for
yeswiki/yeswiki
(Composer)
Jul 9, 2026
Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection
High
CVE-2026-55578
was published
for
pheditor/pheditor
(Composer)
Jul 16, 2026
Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise
Critical
CVE-2026-55579
was published
for
pheditor/pheditor
(Composer)
Jul 16, 2026
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
High
CVE-2026-59931
was published
for
phpoffice/phpspreadsheet
(Composer)
Jul 23, 2026
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
High
CVE-2026-59932
was published
for
phpoffice/phpspreadsheet
(Composer)
Jul 23, 2026
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
High
CVE-2026-59933
was published
for
phpoffice/phpspreadsheet
(Composer)
Jul 23, 2026
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
High
CVE-2026-63135
was published
for
yourls/yourls
(Composer)
Aug 21, 2026
elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections
Moderate
CVE-2026-81890
was published
for
studio-42/elfinder
(Composer)
Sep 2, 2026
ProTip!
Advisories are also available from the
GraphQL API