GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
11 advisories
Axios: Excessive recursion in formDataToJSON can cause denial of service
Moderate
GHSA-42h9-826w-cgv3
was published
for
axios
(npm)
Jul 20, 2026
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication
Moderate
CVE-2026-54246
was published
for
github.com/zalando/skipper
(Go)
Jul 17, 2026
Skipper: Unbounded Request Body Read in Admission Webhook Causes Memory Exhaustion DoS
Moderate
CVE-2026-54247
was published
for
github.com/zalando/skipper
(Go)
Jul 17, 2026
Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
Moderate
CVE-2026-53523
was published
for
github.com/nezhahq/nezha
(Go)
Jun 26, 2026
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
Moderate
CVE-2026-53522
was published
for
github.com/nezhahq/nezha
(Go)
Jun 26, 2026
OpenBao: LDAPi ldaputil (wrong escape func)
Moderate
CVE-2026-55770
was published
for
github.com/openbao/openbao
(Go)
Jun 19, 2026
Cross-site scripting via <NoScript> slot content in Nuxt's head components
Low
GHSA-m3q2-p4fw-w38m
was published
for
nuxt
(npm)
Jun 16, 2026
Deno: WebSocket API sandbox bypass via missing post-DNS check
Moderate
CVE-2026-49860
was published
for
deno
(Rust)
Jun 16, 2026
Deno: `fetch()` API sandbox bypass via missing DNS resolution check
Moderate
CVE-2026-49859
was published
for
deno
(Rust)
Jun 16, 2026
Nuxt dev server vite-node IPC socket is world-connectable on Linux
Moderate
GHSA-534h-c3cw-v3h9
was published
for
nuxt
(npm)
Jun 16, 2026
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`
Moderate
CVE-2026-56326
was published
for
nuxt
(npm)
Jun 16, 2026
ProTip!
Advisories are also available from the
GraphQL API