Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,569
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,522
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

529 advisories

Loading
HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages... Moderate Unreviewed
CVE-2024-23575 was published Jul 17, 2026
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel... Moderate Unreviewed
CVE-2026-56139 was published Jul 6, 2026
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty... Moderate Unreviewed
CVE-2026-49365 was published Jul 6, 2026
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state Moderate
GHSA-qcr8-x557-7cp3 was published for @asymmetric-effort/specifyjs (npm) Jul 2, 2026
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages Moderate
GHSA-6g9v-7gq3-p2c6 was published for surrealdb (Rust) Jul 1, 2026
Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint... Moderate Unreviewed
CVE-2026-56331 was published Jul 1, 2026
IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain... Moderate Unreviewed
CVE-2025-36328 was published Jun 30, 2026
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter High
GHSA-cc8f-fcx3-gpjr was published for surrealdb (Rust) Jun 19, 2026
kah-ja Credited to kah-ja
canto-saas-api: OAuth credentials exposed in URL query string and exception messages Moderate
CVE-2026-55375 was published for jleehr/canto-saas-api (Composer) Jun 19, 2026
jleehr Credited to jleehr
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is... Moderate Unreviewed
CVE-2025-59872 was published Jun 17, 2026
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token Critical
CVE-2026-48039 was published for meta-ads-mcp (pip) Jun 11, 2026
232-323 Credited to 232-323
Spring Web Services: SOAP security faults leak Spring Security account state Moderate
CVE-2026-40997 was published for org.springframework.ws:spring-ws-security (Maven) Jun 11, 2026
Spring Data REST potentially exposes persistence-layer internals to HTTP clients Moderate
CVE-2026-41730 was published for org.springframework.data:spring-data-rest-core (Maven) Jun 10, 2026
Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic Low
CVE-2026-45723 was published for github.com/siderolabs/omni (Go) Jun 5, 2026
bugbunny-research Credited to bugbunny-research
HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability.... Low Unreviewed
CVE-2025-52611 was published Jun 4, 2026
HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during... Moderate Unreviewed
CVE-2025-52606 was published Jun 4, 2026
Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers Moderate
CVE-2026-47248 was published for parse-server (npm) May 29, 2026
offset Credited to offset and mtrezza mtrezza mtrezza
Keycloak Generates an Error Message Containing Sensitive Information Moderate
CVE-2026-9794 was published for org.keycloak:keycloak-services (Maven) May 28, 2026
IBM Business Automation Workflow containers and traditional may leak information about its... Moderate Unreviewed
CVE-2026-1248 was published May 27, 2026
IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2... Moderate Unreviewed
CVE-2024-28765 was published May 27, 2026
In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly... Moderate Unreviewed
CVE-2026-5511 was published May 19, 2026
Algernon: Single-file mode unconditionally enables debug mode High
CVE-2026-45728 was published for github.com/xyproto/algernon (Go) May 19, 2026
Dredsen Credited to Dredsen
Vaadin Build Plugins is Affected by a Possible Information Disclosure Vulnerability Low
CVE-2026-7860 was published for com.vaadin:flow-gradle-plugin (Maven) May 19, 2026
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller... High Unreviewed
CVE-2026-41935 was published May 14, 2026
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak Moderate
CVE-2026-44002 was published for vm2 (npm) May 7, 2026
koDove Credited to koDove
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database