GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
5 advisories
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
High
GHSA-94p4-4cq8-9g67
was published
for
GitPython
(pip)
Jul 24, 2026
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
High
GHSA-g3hq-hphg-8fhh
was published
for
pheditor/pheditor
(Composer)
Jul 24, 2026
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
Moderate
CVE-2026-16732
was published
for
fastify
(npm)
Sep 2, 2026
gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion
Moderate
CVE-2026-84303
was published
for
google.golang.org/grpc
(Go)
Sep 8, 2026
Grav: Stored XSS via Markdown audio/video media <source> URL
Moderate
CVE-2026-75831
was published
for
getgrav/grav
(Composer)
Sep 17, 2026
ProTip!
Advisories are also available from the
GraphQL API