Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,875
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,159
Rust
1,590
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,513
Rust
20

747 advisories

Loading
A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an... Moderate Unreviewed
CVE-2026-105161 was published Oct 4, 2026
In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made... High Unreviewed
CVE-2026-71887 was published Oct 3, 2026
In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no... High Unreviewed
CVE-2026-85515 was published Oct 3, 2026
Zebra (zebrad) 4.5.0 before 6.3.0 discards which peer supplied the block hashes in FindBlocks... Moderate Unreviewed
CVE-2026-104419 was published Oct 2, 2026
The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its... High Unreviewed
CVE-2026-104422 was published Oct 2, 2026
Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A... Unknown Unreviewed
CVE-2026-103878 was published Oct 2, 2026
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard High
CVE-2026-102831 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as... Critical Unreviewed
CVE-2026-89238 was published Sep 30, 2026
PyJWT: PyJWKClient follows redirects when fetching JWKS High
CVE-2026-102267 was published for PyJWT (pip) Sep 29, 2026
NovaHunter06 Credited to NovaHunter06
undici vulnerable to caching and replay of unsafe HTTP method responses Low
CVE-2026-85008 was published for undici (npm) Sep 29, 2026
MegaManSec Credited to MegaManSec, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer High
CVE-2026-102677 was published for electron (npm) Sep 29, 2026
varisys Credited to varisys
A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the... Low Unreviewed
CVE-2026-101278 was published Sep 29, 2026
The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider... Moderate Unreviewed
CVE-2026-92996 was published Sep 28, 2026
The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe... Moderate Unreviewed
CVE-2026-89411 was published Sep 28, 2026
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart... High Unreviewed
CVE-2026-100872 was published Sep 27, 2026
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider Critical
CVE-2026-92161 was published for fof/oauth (Composer) Sep 25, 2026
faran1512 Credited to faran1512
The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware... Critical Unreviewed
CVE-2026-81630 was published Sep 24, 2026
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature... Moderate Unreviewed
CVE-2026-87978 was published Sep 23, 2026
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise... Moderate Unreviewed
CVE-2026-81338 was published Sep 23, 2026
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code... Critical Unreviewed
CVE-2026-28324 was published Sep 22, 2026
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that... Moderate Unreviewed
CVE-2026-92400 was published Sep 21, 2026
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value... Moderate Unreviewed
CVE-2026-92422 was published Sep 20, 2026
AnyCable: Pusher REST API Does Not Verify Request Body MD5 Enabling Signed-Request Replay with Arbitrary Body Moderate
CVE-2026-63405 was published for github.com/anycable/anycable (Go) Sep 18, 2026
de3erve-hunter Credited to de3erve-hunter
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker... Critical Unreviewed
CVE-2026-62874 was published Sep 18, 2026
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses High
CVE-2026-86039 was published for @libp2p/peer-store (npm) Sep 17, 2026
Alleysira Credited to Alleysira
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database