Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,875
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,159
Rust
1,590
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,517
Rust
20
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.

66 advisories

Loading
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as... Critical Unreviewed
CVE-2026-89238 was published Sep 30, 2026
The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware... Critical Unreviewed
CVE-2026-81630 was published Sep 24, 2026
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code... Critical Unreviewed
CVE-2026-28324 was published Sep 22, 2026
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker... Critical Unreviewed
CVE-2026-62874 was published Sep 18, 2026
kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file... Critical Unreviewed
CVE-2026-88592 was published Sep 16, 2026
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... Critical Unreviewed
CVE-2026-80172 was published Sep 9, 2026
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating... Critical Unreviewed
CVE-2026-85434 was published Sep 4, 2026
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on... Critical Unreviewed
CVE-2026-85435 was published Sep 4, 2026
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient... Critical Unreviewed
CVE-2026-82858 was published Aug 31, 2026
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build... Critical Unreviewed
CVE-2026-19410 was published Aug 31, 2026
openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and... Critical Unreviewed
CVE-2026-81706 was published Aug 27, 2026
openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities... Critical Unreviewed
CVE-2026-81702 was published Aug 27, 2026
openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in... Critical Unreviewed
CVE-2026-74890 was published Aug 17, 2026
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema... Critical Unreviewed
CVE-2026-74875 was published Aug 17, 2026
Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. Critical Unreviewed
CVE-2026-28185 was published Aug 13, 2026
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the... Critical Unreviewed
CVE-2026-63687 was published Aug 6, 2026
Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without... Critical Unreviewed
CVE-2026-65583 was published Aug 6, 2026
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling... Critical Unreviewed
CVE-2026-15612 was published Jul 23, 2026
Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that... Critical Unreviewed
CVE-2026-56073 was published Jun 20, 2026
The /v1/Plan service relies entirely on a shared global API token for full administrative... Critical Unreviewed
CVE-2026-50214 was published Jun 4, 2026
A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS,... Critical Unreviewed
CVE-2026-30792 was published Mar 5, 2026
Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi... Critical Unreviewed
CVE-2025-15385 was published Jan 6, 2026
Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni... Critical Unreviewed
CVE-2025-66255 was published Nov 26, 2025
Thunderbird ignored paths when checking the validity of navigations in a frame. This... Critical Unreviewed
CVE-2025-8038 was published Jul 22, 2025
IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks... Critical Unreviewed
CVE-2025-27558 was published May 21, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database