Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,506
Maven
5,000+
npm
5,000+
NuGet
1,091
pip
5,000+
Pub
13
RubyGems
1,144
Rust
1,511
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

1,573 advisories

Loading
Duplicate Advisory: Craft CMS Vulnerable to Stored XSS in Settings Names and Field Options Moderate
GHSA-f95g-vm94-46c3 was published for craftcms/cms (Composer) Jun 21, 2026 • withdrawn
Duplicate Advisory: Craft CMS Vulnerable to Stored XSS via User Group Name in User Permissions Page Moderate
GHSA-9r7j-7jhg-4f4c was published for craftcms/cms (Composer) Jun 21, 2026 • withdrawn
Craft CMS: Stored XSS in the control panel via unescaped draft name Moderate
GHSA-2rp4-x2j7-qmcc was published for craftcms/cms (Composer) Aug 6, 2026
je-lv Credited to je-lv
Duplicate Advisory: Craft CMS has Stored XSS in Table Field in its "Row Heading" Column Type Moderate
GHSA-5w9j-w5p8-r4p7 was published for craftcms/cms (Composer) Jun 21, 2026 • withdrawn
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes Moderate
CVE-2026-71478 was published for league/commonmark (Composer) Aug 6, 2026
TungNGo02 Credited to TungNGo02
Silverstripe: XSS in breadcrumbs in page list view Moderate
CVE-2026-54717 was published for silverstripe/cms (Composer) Aug 6, 2026
Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template Moderate
CVE-2026-71435 was published for statamic/cms (Composer) Aug 6, 2026
ya3raj Credited to ya3raj
TYPO3 Cross-Site Scripting in Fluid ViewHelpers Moderate
GHSA-22q7-cg4r-p9mx was published for typo3/cms-fluid (Composer) May 30, 2024
RainSignal Credited to RainSignal
YesWiki has stored XSS in Bazar form-field templates via unescaped field.label / field.hint (|raw('html')) Moderate
CVE-2026-52772 was published for yeswiki/yeswiki (Composer) Jul 9, 2026
offset Credited to offset
Potential XSS vulnerability in jQuery Moderate
CVE-2020-11022 was published for athlon1600/youtube-downloader (RubyGems) Apr 29, 2020
masatokinugawa Credited to masatokinugawa, Churro, Rudloff, sealonohana, and Athlon1600 Churro Churro
Rudloff Rudloff sealonohana sealonohana Athlon1600 Athlon1600
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload Moderate
CVE-2026-27621 was published for typicms/core (Composer) Feb 25, 2026
lukasz-rybak Credited to lukasz-rybak and sdebacker sdebacker sdebacker
Craft CMS: Stored XSS via Structure entry title in table view Moderate
CVE-2026-55793 was published for craftcms/cms (Composer) Jul 6, 2026
Crypto-Cat Credited to Crypto-Cat
Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector Moderate
CVE-2026-9811 was published for mautic/core (Composer) Jul 2, 2026
pavelkohout396 Credited to pavelkohout396, escopecz, patrykgruszka, and LeuchtfeuerDigitalMarketing escopecz escopecz
patrykgruszka patrykgruszka LeuchtfeuerDigitalMarketing LeuchtfeuerDigitalMarketing
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components Moderate
GHSA-2wwr-9x6f-88gp was published for easycorp/easyadmin-bundle (Composer) Jul 1, 2026
Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS Moderate
CVE-2026-48167 was published for filament/infolists (Composer) Jun 23, 2026
wsparks-vc Credited to wsparks-vc and danharrin danharrin danharrin
Slim has Reflected XSS in the HtmlErrorRenderer Moderate
CVE-2026-48157 was published for slim/slim (Composer) Jun 23, 2026
0xEr3n Credited to 0xEr3n
AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel Moderate
GHSA-7cqp-7cfv-6c3q was published for wwbn/avideo (Composer) Jun 23, 2026
tonghuaroot Credited to tonghuaroot
symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses Moderate
CVE-2026-55877 was published for symfony/ux-icons (Composer) Jun 19, 2026
Kocal Credited to Kocal and Amoifr Amoifr Amoifr
symfony/ux-autocomplete: XSS via unescaped AJAX response data Moderate
CVE-2026-49216 was published for symfony/ux-autocomplete (Composer) Jun 19, 2026
Kocal Credited to Kocal
symfony/ux-live-component: XSS via attacker-controlled child component tag Moderate
CVE-2026-49210 was published for symfony/ux-live-component (Composer) Jun 19, 2026
Amoifr Credited to Amoifr and Kocal Kocal Kocal
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr Moderate
CVE-2026-55890 was published for getgrav/grav (Composer) Jun 18, 2026
CyberKareem Credited to CyberKareem
October Rain has Stored XSS via SVG Filter Bypass Moderate
CVE-2026-25133 was published for october/rain (Composer) Apr 14, 2026
daftspunk Credited to daftspunk and mbadanoiu mbadanoiu mbadanoiu
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes Moderate
CVE-2026-48761 was published for symfony/html-sanitizer (Composer) Jun 15, 2026
tob-scott-a Credited to tob-scott-a and nicolas-grekas nicolas-grekas nicolas-grekas
TYPO3 HTML Sanitizer allows Cross-site Scripting Moderate
CVE-2026-47345 was published for typo3/html-sanitizer (Composer) Jun 12, 2026
TYPO3 CMS has Cross-Site Scripting in Indexed Search Moderate
CVE-2026-47348 was published for typo3/cms-core (Composer) Jun 12, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database