GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
10 advisories
FUXA Unauthenticated Remote Arbitrary Device Tag Write
Critical
CVE-2026-25752
was published
for
fuxa-server
(npm)
Feb 5, 2026
FUXA Unauthenticated Remote Arbitrary Scheduler Write
Critical
CVE-2026-25939
was published
for
fuxa-server
(npm)
Feb 10, 2026
Parse Dashboard is Missing Authorization for its Agent Endpoint
Critical
CVE-2026-27608
was published
for
parse-dashboard
(npm)
Feb 25, 2026
OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account takeover
Critical
CVE-2026-30956
was published
for
@oneuptime/common
(npm)
Mar 10, 2026
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
Critical
CVE-2026-22172
was published
for
openclaw
(npm)
Mar 13, 2026
Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity
Critical
CVE-2026-33950
was published
for
signalk-server
(npm)
Apr 3, 2026
@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections
Critical
CVE-2026-39397
was published
for
@delmaredigital/payload-puck
(npm)
Apr 8, 2026
ProTip!
Advisories are also available from the
GraphQL API