Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,901
Maven
5,000+
npm
5,000+
NuGet
1,143
pip
5,000+
Pub
13
RubyGems
1,159
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,555
Rust
20

359 advisories

Loading
Payload: Untrusted redirect URL parameter exploit Moderate
CVE-2026-105846 was published for @payloadcms/next (npm) Oct 6, 2026
kullai-secasure Credited to kullai-secasure and yuvraj-secasure yuvraj-secasure yuvraj-secasure
chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes Moderate
CVE-2025-71405 was published for github.com/go-chi/chi/v5 (Go) Jun 20, 2025
anuraagbaishya Credited to anuraagbaishya
Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes Moderate
GHSA-xcvf-46f4-xwxf was published for github.com/go-chi/chi (Go) Aug 14, 2026 • withdrawn
Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp` Moderate
CVE-2026-56326 was published for nuxt (npm) Jun 16, 2026
alcls01111 Credited to alcls01111, cookesan, and sealonohana cookesan cookesan
sealonohana sealonohana
Semantic MediaWiki has an open redirect in Special:URIResolver Moderate
CVE-2026-77609 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
React Router: Open redirect leading to XSS Moderate
CVE-2026-53668 was published for react-router (npm) Jul 23, 2026
SouadSEBAA Credited to SouadSEBAA, zachmitch31, and brophdawg11 zachmitch31 zachmitch31
brophdawg11 brophdawg11
Snipe-IT has an Open Redirect After User Edit Moderate
CVE-2026-55461 was published for snipe/snipe-it (Composer) Aug 28, 2026
mamdouhmahfouz Credited to mamdouhmahfouz
Pocket-ID has an Open Redirect on the OIDC /authorize page via unvalidated redirect_uri with prompt=none Moderate
CVE-2026-55834 was published for github.com/pocket-id/pocket-id/backend (Go) Aug 28, 2026
geo-chen Credited to geo-chen
WebOb: Open redirect in Location header normalization via leading C0 control / space characters Moderate
CVE-2026-54770 was published for webob (pip) Aug 27, 2026
tonghuaroot Credited to tonghuaroot, digitalresistor, and polkorny digitalresistor digitalresistor
polkorny polkorny
Jenkins Open Redirect Through Newline/Tab Characters in Redirect URL Moderate
CVE-2026-53437 was published for org.jenkins-ci.main:jenkins-core (Maven) Jun 10, 2026
CakePHP Authentication: Open redirect weakness via backslash bypass Moderate
CVE-2026-55590 was published for cakephp/authentication (Composer) Jun 17, 2026
edorian Credited to edorian, markstory, and aquaturtlium markstory markstory
aquaturtlium aquaturtlium
Jenkins: Open Redirect phishing attacks possible via "from" parameter in "Delegate to servlet container" Moderate
CVE-2026-53440 was published for org.jenkins-ci.main:jenkins-core (Maven) Jun 10, 2026
Jenkins Open Redirect via Relative Path Segments in Post-Login Redirect URL Moderate
CVE-2026-53436 was published for org.jenkins-ci.main:jenkins-core (Maven) Jun 10, 2026
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass Moderate
CVE-2026-73563 was published for @backstage/plugin-auth-backend (npm) Jul 24, 2026
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header Moderate
CVE-2026-55087 was published for ep_etherpad-lite (npm) Aug 13, 2026
Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter Moderate
CVE-2026-41008 was published for org.springframework.security:spring-security-oauth2-authorization-server (Maven) Jun 10, 2026
Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache Moderate
CVE-2026-41706 was published for org.springframework.security:spring-security-web (Maven) Jun 10, 2026
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation Moderate
CVE-2026-40181 was published for @remix-run/router (npm) Jun 3, 2026
sealonohana Credited to sealonohana
core-geonetwork has an Open Redirect Bypass Moderate
CVE-2026-53573 was published for org.geonetwork-opensource:geonetwork (Maven) Jul 31, 2026
Fushuling Credited to Fushuling, RacerZ-fighting, and juanluisrp RacerZ-fighting RacerZ-fighting
juanluisrp juanluisrp
Spring Framework Open Redirect in Spring MVC and WebFlux Moderate
CVE-2026-41844 was published for org.springframework:spring-webflux (Maven) Jun 9, 2026
React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass) Moderate
CVE-2026-53669 was published for react-router (npm) Jul 23, 2026
outring Credited to outring
Gogs has an Open Redirect via redirect_to Moderate
CVE-2026-52802 was published for gogs.io/gogs (Go) Jun 23, 2026
quirmz Credited to quirmz
NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin Moderate
CVE-2026-47377 was published for nocodb (npm) Jun 5, 2026
fg0x0 Credited to fg0x0
WebOb: Location header normalization during redirect leads to open redirect - again Moderate
CVE-2026-44889 was published for webob (pip) Jun 4, 2026
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type Moderate
CVE-2026-41479 was published for authlib (pip) Jun 8, 2026
rise0311 Credited to rise0311
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database