Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,875
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,159
Rust
1,590
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,513
Rust
20

83 advisories

Loading
core-geonetwork has an Open Redirect Bypass Moderate
CVE-2026-53573 was published for org.geonetwork-opensource:geonetwork (Maven) Jul 31, 2026
Fushuling Credited to Fushuling, RacerZ-fighting, and juanluisrp RacerZ-fighting RacerZ-fighting
juanluisrp juanluisrp
Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL Moderate
CVE-2026-53436 was published for org.jenkins-ci.main:jenkins-core (Maven) Jun 10, 2026
Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container" Moderate
CVE-2026-53440 was published for org.jenkins-ci.main:jenkins-core (Maven) Jun 10, 2026
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL Moderate
CVE-2026-53437 was published for org.jenkins-ci.main:jenkins-core (Maven) Jun 10, 2026
Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter Moderate
CVE-2026-41008 was published for org.springframework.security:spring-security-oauth2-authorization-server (Maven) Jun 10, 2026
Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache Moderate
CVE-2026-41706 was published for org.springframework.security:spring-security-web (Maven) Jun 10, 2026
Spring Framework Open Redirect in Spring MVC and WebFlux Moderate
CVE-2026-41844 was published for org.springframework:spring-webflux (Maven) Jun 9, 2026
hsweb-framework has an open redirect issue Low
CVE-2026-11477 was published for org.hswebframework.web:hsweb-authorization-oauth2 (Maven) Jun 8, 2026
Jenkins Bitbucket OAuth Plugin does not restrict the redirect URL after login Moderate
CVE-2026-48924 was published for org.jenkins-ci.plugins:bitbucket-oauth (Maven) May 27, 2026
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login Low
CVE-2026-48589 was published for org.apache.shiro:shiro-jakarta-ee (Maven) May 26, 2026
yeikel Credited to yeikel
Apache Shiro Vulnerable to Open Redirect, Server-Side Request Forgery Moderate
CVE-2026-44598 was published for org.apache.shiro:shiro-jakarta-ee (Maven) May 26, 2026
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak High
CVE-2026-7504 was published for org.keycloak:keycloak-services (Maven) May 19, 2026
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect High
CVE-2026-44503 was published for Microsoft.Kiota.Abstractions (Go) May 7, 2026
MIchaelMainer Credited to MIchaelMainer, awsactran, and sgracia714 awsactran awsactran
sgracia714 sgracia714
Jenkins Microsoft Entra ID (previously Azure AD) Plugin has an open redirect vulnerability Moderate
CVE-2026-42525 was published for org.jenkins-ci.plugins:azure-ad (Maven) Apr 29, 2026
Apache Tomcat has an Open Redirect vulnerability Moderate
CVE-2026-25854 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Apr 9, 2026
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint High
CVE-2026-3872 was published for org.keycloak:keycloak-services (Maven) Apr 2, 2026
Central Dogma's Login Function Has an Open Redirect Vulnerability Moderate
CVE-2025-11222 was published for com.linecorp.centraldogma:centraldogma-server-auth-shiro (Maven) Dec 4, 2025
minwoox Credited to minwoox
Liferay Portal is vulnerable to DNS rebinding attacks Moderate
CVE-2025-62266 was published for com.liferay.portal:release.portal.bom (Maven) Oct 30, 2025
Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter Moderate
CVE-2025-62253 was published for com.liferay:com.liferay.layout.admin.web (Maven) Oct 27, 2025
Liferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect Moderate
CVE-2025-43795 was published for com.liferay:com.liferay.configuration.admin.web (Maven) Sep 12, 2025
Liferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect Moderate
CVE-2025-43767 was published for com.liferay:com.liferay.info.impl (Maven) Aug 23, 2025
XXL SSO is vulnerable to an Open Redirect through malicious manipulation of the redirect_url argument Low
CVE-2025-6701 was published for com.xuxueli:xxl-sso (Maven) Jun 26, 2025
WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint Moderate
CVE-2024-1440 was published for org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.endpoint.util (Maven) Jun 2, 2025
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability Moderate
CVE-2025-32970 was published for org.xwiki.platform:xwiki-platform-wysiwyg-api (Maven) Apr 29, 2025
Apache Druid vulnerable to Server-Side Request Forgery, Cross-site Scripting, Open Redirect Moderate
CVE-2025-27888 was published for org.apache.druid:druid (Maven) Mar 20, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database