Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,506
Maven
5,000+
npm
5,000+
NuGet
1,091
pip
5,000+
Pub
13
RubyGems
1,144
Rust
1,511
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

13 advisories

Loading
Filament: Unauthenticated temporary file upload on auth pages Moderate
CVE-2026-48500 was published for filament/filament (Composer) Jun 23, 2026
wsparks-vc Credited to wsparks-vc and danharrin danharrin danharrin
Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS Moderate
CVE-2026-48167 was published for filament/infolists (Composer) Jun 23, 2026
wsparks-vc Credited to wsparks-vc and danharrin danharrin danharrin
Filament: Timing-based user enumeration on login page Moderate
CVE-2026-48166 was published for filament/filament (Composer) Jun 23, 2026
wsparks-vc Credited to wsparks-vc and danharrin danharrin danharrin
python-statemachine SCXML <data expr> Eval Injection Critical
CVE-2026-47103 was published for python-statemachine (pip) Jun 18, 2026
wsparks-vc Credited to wsparks-vc and SaiTeja-Erukude SaiTeja-Erukude SaiTeja-Erukude
Twig: Possible sandbox bypass when using a source policy High
CVE-2026-24425 was published for twig/twig (Composer) Jun 5, 2026
fabpot Credited to fabpot, wsparks-vc, XavLimSG, and Vincent550102 wsparks-vc wsparks-vc
XavLimSG XavLimSG Vincent550102 Vincent550102
HAXcms createSite SSRF Enables Arbitrary File Read High
CVE-2026-46393 was published for @haxtheweb/haxcms-nodejs (npm) May 19, 2026
wsparks-vc Credited to wsparks-vc and d6fault d6fault d6fault
Flowise: APIChain Prompt Injection SSRF in GET/POST API Chains High
CVE-2026-41271 was published for flowise (npm) Apr 16, 2026
wsparks-vc Credited to wsparks-vc
OpenClaw Host-Exec Environment Variable Injection Moderate
GHSA-w9j9-w4cp-6wgr was published for openclaw (npm) Apr 9, 2026
wsparks-vc Credited to wsparks-vc
OpenClaw: Windows-compatible env override keys could bypass system.run approval binding Moderate
GHSA-98ch-45wp-ch47 was published for openclaw (npm) Apr 7, 2026
wsparks-vc Credited to wsparks-vc and iskindar iskindar iskindar
OpenClaw's complex interpreter pipelines could skip exec script preflight validation Moderate
CVE-2026-34425 was published for openclaw (npm) Apr 6, 2026
wsparks-vc Credited to wsparks-vc and iskindar iskindar iskindar
OpenClaw: Media Parsing Path Traversal Leads to Arbitrary File Read High
GHSA-f6pf-4gjx-c94r was published for openclaw (npm) Apr 3, 2026
wsparks-vc Credited to wsparks-vc and iskindar iskindar iskindar
LibreNMS /port-groups name Stored Cross-Site Scripting Moderate
CVE-2026-26992 was published for librenms/librenms (Composer) Feb 18, 2026
wsparks-vc Credited to wsparks-vc and awoffsec awoffsec awoffsec
LibreNMS /device-groups name Stored Cross-Site Scripting Moderate
CVE-2026-26991 was published for librenms/librenms (Composer) Feb 18, 2026
wsparks-vc Credited to wsparks-vc and awoffsec awoffsec awoffsec
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database