Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
50
Go
3,630
Maven
5,000+
npm
5,000+
NuGet
928
pip
4,850
Pub
13
RubyGems
1,045
Rust
1,301
Swift
53
Unreviewed advisories
All unreviewed
5,000+

139 advisories

Loading
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS) Moderate
CVE-2026-35040 was published for fast-jwt (npm) Apr 9, 2026
fasrm Credited to fasrm and SociableSteve SociableSteve SociableSteve
Parse Server has a session field immutability bypass via falsy-value guard Moderate
CVE-2026-34574 was published for parse-server (npm) Apr 1, 2026
bugbunny-research Credited to bugbunny-research and mtrezza mtrezza mtrezza
mppx has Stripe charge credential replay via missing idempotency check Moderate
CVE-2026-34210 was published for mppx (npm) Mar 29, 2026
samczsun Credited to samczsun and veria-labs veria-labs veria-labs
Bug fixes in hpke-rs, hpke-rs-rust-crypto High
GHSA-g433-pq76-6cmf was published for hpke-rs (Rust) Feb 13, 2026
xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the... Moderate Unreviewed
CVE-2005-2801 was published May 1, 2022
Logic error in authentication in proxy.py High
CVE-2021-3116 was published for proxy.py (pip) Apr 7, 2021
A potential attacker with access to the Westermo Lynx device would be able to execute... Moderate Unreviewed
CVE-2023-45213 was published Feb 7, 2024
rs-soroban-sdk: `Fr` scalar field equality comparison bypasses modular reduction Moderate
CVE-2026-32322 was published for soroban-sdk (Rust) Mar 13, 2026
leighmcculloch Credited to leighmcculloch
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling High
CVE-2025-47776 was published for mantisbt/mantisbt (Composer) Nov 3, 2025
dregad Credited to dregad and piru piru piru
PickleScan's profile.run blocklist mismatch allows exec() bypass Critical
GHSA-7wx9-6375-f5wh was published for picklescan (pip) Mar 3, 2026
yash2998chhabria Credited to yash2998chhabria
Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass High
CVE-2026-26275 was published for httpsig-hyper (Rust) Feb 17, 2026
divi255 Credited to divi255
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures... High Unreviewed
CVE-2025-20343 was published Nov 5, 2025
The Events Calendar plugin for WordPress is vulnerable to information disclosure in versions up... Moderate Unreviewed
CVE-2025-12192 was published Nov 5, 2025
Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function... Moderate Unreviewed
CVE-2023-49994 was published Dec 12, 2023
gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream... High Unreviewed
CVE-2023-46009 was published Oct 18, 2023
The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6... High Unreviewed
CVE-2024-4032 was published Jun 17, 2024
TCPDF has incorrect comparison High
CVE-2024-56522 was published for tecnickcom/tcpdf (Composer) Dec 27, 2024
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's... Moderate Unreviewed
CVE-2024-9681 was published Nov 6, 2024
ServiceNow has addressed an input validation vulnerability that was identified in the Washington... Critical Unreviewed
CVE-2024-5217 was published Jul 10, 2024
Unraid 6.8.0 allows authentication bypass. High Unreviewed
CVE-2020-5849 was published May 24, 2022
Dragonfly vulnerable to timing attacks against Proxy’s basic authentication Moderate
CVE-2025-59350 was published for d7y.io/dragonfly/v2 (Go) Sep 17, 2025
gaius-qi Credited to gaius-qi
A vulnerability exists in the ConsoleFindCommandMatchList function in libsymproc. so imported by... Moderate Unreviewed
CVE-2025-47416 was published Sep 9, 2025
In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct... Critical Unreviewed
CVE-2025-54336 was published Aug 19, 2025
A vulnerability has been found in HuangDou UTCMS 9. This vulnerability affects unknown code of... Moderate Unreviewed
CVE-2025-9401 was published Aug 25, 2025
IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could... Moderate Unreviewed
CVE-2025-27909 was published Aug 18, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database