Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

111 advisories

Loading
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An... High Unreviewed
CVE-2026-73266 was published Aug 13, 2026
Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without... Moderate Unreviewed
CVE-2026-86115 was published Sep 5, 2026
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due... Critical Unreviewed
CVE-2026-83548 was published Sep 2, 2026
Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75... Moderate Unreviewed
CVE-2026-84329 was published Sep 2, 2026
Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation High
CVE-2026-46592 was published for org.apache.camel:camel-cxf-rest (Maven) Jul 6, 2026
oscerd Credited to oscerd
A flaw was found in the multicloud-integrations component. The Application propagation controller... Critical Unreviewed
CVE-2026-72526 was published Aug 12, 2026
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a... Critical Unreviewed
CVE-2026-67567 was published Aug 20, 2026
A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management ... Critical Unreviewed
CVE-2026-70398 was published Aug 12, 2026
In setupLayout of PickActivity.java, there is a possible way to start any activity as a... High Unreviewed
CVE-2026-0013 was published Mar 2, 2026
MagicMirror: ssrf calendar .js Moderate
CVE-2026-63643 was published for magicmirror (npm) Aug 18, 2026
gabrie0x6c Credited to gabrie0x6c
Astro: Unauthenticated path override in the @astrojs/vercel ISR function Moderate
CVE-2026-73424 was published for @astrojs/vercel (npm) Jul 20, 2026
jp-soba Credited to jp-soba
The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an... Moderate Unreviewed
CVE-2026-72640 was published Aug 13, 2026
A flaw was found in the `odh-model-controller`. An authenticated user with permissions to create... Moderate Unreviewed
CVE-2026-16456 was published Aug 10, 2026
The OnCallNotificationActivity in the Datadog Android application is declared android:exported=... Moderate Unreviewed
CVE-2026-44964 was published Aug 7, 2026
PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes Moderate
CVE-2026-48522 was published for PyJWT (pip) Jun 15, 2026
KEIJOT Credited to KEIJOT and shaked-seal shaked-seal shaked-seal
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster... High Unreviewed
CVE-2026-17107 was published Jul 24, 2026
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` Moderate
CVE-2026-54663 was published for swagger-typescript-api (npm) Jul 29, 2026
thegr1ffyn Credited to thegr1ffyn
java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor High
CVE-2026-43910 was published for io.appium:java-client (Maven) Jul 28, 2026
RobertoLuzanilla Credited to RobertoLuzanilla
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary... Critical Unreviewed
CVE-2026-42933 was published Jul 24, 2026
An authenticated user with write privileges on a Queryable Encryption-enabled collection may be... High Unreviewed
CVE-2026-13062 was published Jul 22, 2026
NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint Moderate
CVE-2026-53931 was published for nocodb (npm) Jun 17, 2026
p- Credited to p-
Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin High
CVE-2026-53514 was published for better-auth (npm) Jul 7, 2026
widavies Credited to widavies
@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints Critical
CVE-2026-53513 was published for @better-auth/sso (npm) Jul 7, 2026
vaadata-poyetont Credited to vaadata-poyetont
Angular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities Moderate
CVE-2026-50169 was published for @angular/service-worker (npm) Jun 15, 2026
Yenya030 Credited to Yenya030, alan-agius4, JeanMeche, josephperrott, and AndrewKushnir alan-agius4 alan-agius4
JeanMeche JeanMeche josephperrott josephperrott AndrewKushnir AndrewKushnir
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode High
CVE-2026-54628 was published for github.com/julien040/anyquery (Go) Jul 14, 2026
Metincloup Credited to Metincloup
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database