Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

17 advisories

Loading
Ratpack's default client side session signing key is highly predictable Moderate
CVE-2021-29480 was published for io.ratpack:ratpack-session (Maven) Jul 1, 2021
JLLeitschuh Credited to JLLeitschuh
Puppet uses predictable filenames, allowing arbitrary file overwrite Moderate
CVE-2011-3871 was published for puppet (RubyGems) May 14, 2022
Generation of predictable identifiers issue exists in Cente middleware TCP/IP Network Series. If... Moderate Unreviewed
CVE-2024-28957 was published Apr 15, 2024
JUJU_CONTEXT_ID is a predictable authentication secret Moderate
CVE-2024-7558 was published for github.com/juju/juju (Go) Oct 3, 2024
hpidcock Credited to hpidcock and lucistanescu lucistanescu lucistanescu
Salt preflight script could be attacker controlled Moderate
CVE-2023-34049 was published for salt (pip) Nov 14, 2024
The Advanced Google reCAPTCHA plugin for WordPress is vulnerable to IP unblocking in all versions... Moderate Unreviewed
CVE-2024-12034 was published Dec 24, 2024
Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's... Moderate Unreviewed
CVE-2024-10603 was published Jan 30, 2025
On BIG-IP systems, undisclosed traffic can cause data corruption and unauthorized data... Moderate Unreviewed
CVE-2025-58424 was published Oct 15, 2025
When batch jobs are executed by pgAgent, a script is created in a temporary directory and then... Moderate Unreviewed
CVE-2025-0218 was published Jan 7, 2025
The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's... Moderate Unreviewed
CVE-2025-59452 was published Oct 6, 2025
Improper S3 ownership verification in Bedrock AgentCore Starter Toolkit Moderate
CVE-2026-4269 was published for bedrock-agentcore-starter-toolkit (pip) Mar 17, 2026
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows... Moderate Unreviewed
CVE-2025-13044 was published Apr 7, 2026
Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port Moderate
CVE-2026-45673 was published for io.netty:netty-resolver-dns (Maven) Jun 8, 2026
violetagg Credited to violetagg
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters,... Moderate Unreviewed
CVE-2026-42932 was published Jun 12, 2026
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can... Moderate Unreviewed
CVE-2026-47085 was published Jul 16, 2026
The application generates uploaded file names using a weak and predictable method based on the... Moderate Unreviewed
CVE-2025-14602 was published Aug 20, 2026
ATutor generates predictable email confirmation tokens due to the use of insufficiently random... Moderate Unreviewed
CVE-2026-64964 was published Aug 20, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database