Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
44
GitHub Actions
45
Go
3,196
Maven
5,000+
npm
5,000+
NuGet
864
pip
4,483
Pub
12
RubyGems
992
Rust
1,186
Swift
51
Unreviewed advisories
All unreviewed
5,000+

50 advisories

Loading
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of... Critical Unreviewed
CVE-2026-28775 was published Mar 4, 2026
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise Critical
CVE-2026-26190 was published for github.com/milvus-io/milvus (Go) Feb 11, 2026
0x1f Credited to 0x1f
UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default... Critical Unreviewed
CVE-2025-70998 was published Feb 18, 2026
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration Critical
CVE-2026-25894 was published for fuxa-server (npm) Feb 5, 2026
wodzen Credited to wodzen
Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer Critical
CVE-2025-62877 was published for github.com/harvester/harvester-installer (Go) Jan 5, 2026
Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin... Critical Unreviewed
CVE-2025-56332 was published Dec 30, 2025
Ray's New Token Authentication is Disabled By Default Critical
CVE-2025-34351 was published for ray (pip) Nov 27, 2025
The default configuration of WatchGuard Firebox devices through 2025-09-10 allows administrative... Critical Unreviewed
CVE-2025-59396 was published Nov 6, 2025
The affected devices use publicly available default credentials with administrative privileges. Critical Unreviewed
CVE-2023-39169 was published Dec 7, 2023
Authentication bypass in Apache Airflow Critical
CVE-2020-13927 was published for apache-airflow (pip) Apr 30, 2021
sunSUNQ Credited to sunSUNQ
Unitronics Vision Series PLCs and HMIs use default administrative passwords. An unauthenticated... Critical Unreviewed
CVE-2023-6448 was published Dec 5, 2023
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default... Critical Unreviewed
CVE-2022-24706 was published Apr 27, 2022
The HEIDENHAIN Controller TNC 640, version 340590 07 SP5, running HEROS 5.08.3 controlling the... Critical Unreviewed
CVE-2022-41648 was published Oct 28, 2022
A security issue exists due to the web-based debugger agent enabled on Rockwell Automation... Critical Unreviewed
CVE-2025-7353 was published Aug 14, 2025
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access Critical
CVE-2025-54127 was published for @haxtheweb/haxcms-nodejs (npm) Jul 21, 2025
asareynolds Credited to asareynolds
A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain... Critical Unreviewed
CVE-2025-41672 was published Jul 7, 2025
The Versa Director software exposes a number of services by default and allow attackers an easy... Critical Unreviewed
CVE-2025-24288 was published Jun 19, 2025
The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even... Critical Unreviewed
CVE-2025-41438 was published May 30, 2025
An issue was discovered in Schneider Electric Tableau Server/Desktop Versions 7.0 to 10.1.3 in... Critical Unreviewed
CVE-2017-5178 was published May 13, 2022
Insecure default settings have been found in recorder products provided by Yokogawa Electric... Critical Unreviewed
CVE-2025-1863 was published Apr 18, 2025
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could... Critical Unreviewed
CVE-2025-1960 was published Mar 12, 2025
Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) Critical
CVE-2024-25610 was published for com.liferay.portal:com.liferay.portal.web (Maven) Feb 20, 2024
A condition exists in FlashArray Purity whereby a local account intended for initial array... Critical Unreviewed
CVE-2024-0001 was published Sep 23, 2024
Initialization of a resource with an insecure default vulnerability in FutureNet NXR series, VXR... Critical Unreviewed
CVE-2024-31070 was published Jul 17, 2024
A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4... Critical Unreviewed
CVE-2024-28815 was published Mar 27, 2024
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database