GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
9,551 advisories
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
High
GHSA-cwxj-rr6w-m6w7
was published
for
Scrapy
(pip)
Mar 13, 2026
Deno vulnerable to command Injection via incomplete shell metacharacter blocklist in node:child_process
High
CVE-2026-32260
was published
for
deno
(Rust)
Mar 13, 2026
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
High
CVE-2026-32308
was published
for
oneuptime
(npm)
Mar 13, 2026
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
High
CVE-2026-31899
was published
for
CairoSVG
(pip)
Mar 13, 2026
OpenClaw: Sandbox staged writes could escape the verified parent directory before commit
High
GHSA-mj4p-rc52-m843
was published
for
openclaw
(npm)
Mar 13, 2026
OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity
High
GHSA-qc36-x95h-7j53
was published
for
openclaw
(npm)
Mar 13, 2026
OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv
High
GHSA-rw39-5899-8mxp
was published
for
openclaw
(npm)
Mar 13, 2026
OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity
High
GHSA-xf99-j42q-5w5p
was published
for
openclaw
(npm)
Mar 13, 2026
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
High
GHSA-4w7m-58cg-cmff
was published
for
openclaw
(npm)
Mar 13, 2026
flatted vulnerable to unbounded recursion DoS in parse() revive phase
High
CVE-2026-32141
was published
for
flatted
(npm)
Mar 13, 2026
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
High
CVE-2026-32116
was published
for
magic-wormhole
(pip)
Mar 13, 2026
Dagu: SSE Authentication Bypass in Basic Auth Mode
High
CVE-2026-31882
was published
for
dagu
(npm)
Mar 13, 2026
Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload
High
CVE-2026-32319
was published
for
github.com/ellanetworks/core
(Go)
Mar 12, 2026
OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode
High
CVE-2026-32302
was published
for
openclaw
(npm)
Mar 12, 2026
TinaCMS Vulnerable to Path Traversal Leading to Arbitrary File Read, Write and Delete
High
CVE-2026-28793
was published
for
@tinacms/cli
(npm)
Mar 12, 2026
Black: Arbitrary file writes from unsanitized user input in cache file name
High
CVE-2026-32274
was published
for
black
(pip)
Mar 12, 2026
Tina: Path Traversal in Media Upload Handle
High
CVE-2026-28791
was published
for
tinacms
(npm)
Mar 12, 2026
multipart vulnerable to ReDoS in `parse_options_header()`
High
CVE-2026-28356
was published
for
multipart
(pip)
Mar 12, 2026
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
High
CVE-2026-32247
was published
for
graphiti-core
(pip)
Mar 12, 2026
Tinyauth vulnerable to TOTP/2FA bypass via OIDC authorize endpoint
High
CVE-2026-32246
was published
for
github.com/steveiliop56/tinyauth
(Go)
Mar 12, 2026
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
High
CVE-2026-32232
was published
for
zeptoclaw
(Rust)
Mar 12, 2026
ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data
High
CVE-2026-32231
was published
for
zeptoclaw
(Rust)
Mar 12, 2026
StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
High
CVE-2026-32101
was published
for
@studiocms/s3-storage
(npm)
Mar 12, 2026
ProTip!
Advisories are also available from the
GraphQL API