Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,512
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,145
Rust
1,512
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

15 advisories

Loading
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions High
CVE-2026-54593 was published for github.com/pterodactyl/wings (Composer) Jul 28, 2026
TrixterTheTux Credited to TrixterTheTux
Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints Moderate
CVE-2026-58429 was published for code.gitea.io/gitea (Go) Jul 21, 2026
Pcat2003 Credited to Pcat2003
Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue... High Unreviewed
CVE-2026-25700 was published Jun 10, 2026
OpenBao's Token Store Allows Cross-Namespace Renewal, Revocation Low
CVE-2026-40264 was published for github.com/openbao/openbao (Go) Apr 21, 2026
Zwique Credited to Zwique
jose4j is vulnerable to DoS via compressed JWE content High
CVE-2024-29371 was published for org.bitbucket.b_c:jose4j (Maven) Dec 17, 2025
ShichengRao Credited to ShichengRao
A security flaw in the '_transfer' function of a smart contract implementation for Money Making... Moderate Unreviewed
CVE-2025-56207 was published Sep 30, 2025
TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset... Moderate Unreviewed
CVE-2025-56676 was published Sep 30, 2025
An information disclosure vulnerability exists in multiple WSO2 products due to improper... Moderate Unreviewed
CVE-2024-4598 was published Sep 23, 2025
A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access... Moderate Unreviewed
CVE-2025-50579 was published Aug 19, 2025
In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token... Moderate Unreviewed
CVE-2025-51306 was published Aug 6, 2025
Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains... Moderate Unreviewed
CVE-2025-27955 was published Jun 2, 2025
Page table protection configuration vulnerability in the trusted firmware module Impact:... Moderate Unreviewed
CVE-2024-45448 was published Sep 4, 2024
biscuit-java vulnerable to public key confusion in third party block Moderate
CVE-2024-41948 was published for org.biscuitsec:biscuit (Maven) Jul 31, 2024
Volcano has insecure permissions Critical
CVE-2024-36533 was published for github.com/volcano-sh/volcano (Go) Jul 24, 2024
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC Moderate
CVE-2022-23541 was published for jsonwebtoken (npm) Dec 22, 2022
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database