Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,569
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,522
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

67 advisories

Loading
Missing hostname validation in Kroxylicious Moderate
CVE-2024-8285 was published for io.kroxylicious:kroxylicious-runtime (Maven) Aug 31, 2024
ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass High
CVE-2024-32868 was published for github.com/zitadel/zitadel (Go) Apr 25, 2024
livio-a Credited to livio-a, Skelmis, itz-d0dgy, amit-laish, muhlemmer, and peintnermax Skelmis Skelmis
itz-d0dgy itz-d0dgy amit-laish amit-laish muhlemmer muhlemmer peintnermax peintnermax
IBM OpenPages with Watson 8.3 and 9.0  could allow a remote attacker to spoof mail server... Moderate Unreviewed
CVE-2024-49782 was published Feb 20, 2025
In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin Moderate Unreviewed
CVE-2025-42921 was published Apr 17, 2025
Missing hostname validation in Jenkins View26 Test-Reporting Plugin Moderate
CVE-2022-41244 was published for org.jenkins-ci.plugins:view26 (Maven) Sep 22, 2022
NotMyFault Credited to NotMyFault
Duplicate Advisory: Keycloak hostname verification High
GHSA-r934-w73g-v4p8 was published for org.keycloak:keycloak-services (Maven) Apr 29, 2025 • withdrawn
A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7... Moderate Unreviewed
CVE-2024-54019 was published Jun 10, 2025
Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates Moderate
CVE-2025-49015 was published for CouchbaseNetClient (NuGet) Jun 18, 2025
libcurl did not check the server certificate of TLS connections done to a host specified as an IP... Moderate Unreviewed
CVE-2024-2466 was published Mar 27, 2024
Keycloak hostname verification High
CVE-2025-3501 was published for org.keycloak:keycloak-services (Maven) Apr 30, 2025
sharpedavid Credited to sharpedavid
The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which... High Unreviewed
CVE-2025-2190 was published Mar 11, 2025
An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and push... Critical Unreviewed
CVE-2025-46408 was published Sep 15, 2025
Apache Log4j does not verify the TLS hostname in its Socket Appender Moderate
CVE-2025-68161 was published for org.apache.logging.log4j:log4j-core (Maven) Dec 18, 2025
ppkarwasz Credited to ppkarwasz
The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname... Critical Unreviewed
CVE-2025-68637 was published Jan 7, 2026
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file,... Moderate Unreviewed
CVE-2025-15079 was published Jan 8, 2026
JRuby-OpenSSL has hostname verification disabled by default Moderate
CVE-2025-46551 was published for jruby-openssl (RubyGems) May 7, 2025
mohamedhafez Credited to mohamedhafez
Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS... Critical Unreviewed
CVE-2026-26214 was published Feb 12, 2026
Apache Ranger Vulnerable to Improper Validation of Certificate with Host Mismatch Moderate
CVE-2025-59060 was published for org.apache.ranger:ranger-nifi-registry-plugin (Maven) Mar 3, 2026
Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager High
CVE-2026-24281 was published for org.apache.zookeeper:zookeeper (Maven) Mar 7, 2026
kascit Credited to kascit
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration Moderate
CVE-2026-34477 was published for org.apache.logging.log4j:log4j-core (Maven) Apr 10, 2026
ppkarwasz Credited to ppkarwasz
Bouncy Castle Java Cryptography API vulnerable to DNS poisoning Moderate
CVE-2024-34447 was published for org.bouncycastle:bcprov-jdk12 (Maven) May 3, 2024
samueloph Credited to samueloph, binary-1024, hmolsen, and kmoens binary-1024 binary-1024
hmolsen hmolsen kmoens kmoens
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates Moderate
CVE-2026-22747 was published for org.springframework.security:spring-security-web (Maven) Apr 22, 2026
Improper Validation of Certificate with Host Mismatch vulnerability in Akınsoft QR Menü allows... High Unreviewed
CVE-2024-12925 was published Jun 1, 2026
Apache Thrift has an Improper Validation of Certificate with Host Mismatch Vulnerability High
CVE-2026-43869 was published for org.apache.thrift:libthrift (Maven) May 5, 2026
ataillefer Credited to ataillefer and HTHou HTHou HTHou
Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows... Moderate Unreviewed
CVE-2025-4295 was published Jul 22, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database