Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,863
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,158
Rust
1,585
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,513
Rust
20

3,330 advisories

Loading
Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform... Moderate Unreviewed
CVE-2026-80464 was published Oct 2, 2026
A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp... Moderate Unreviewed
CVE-2026-104120 was published Oct 2, 2026
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not... Moderate Unreviewed
CVE-2026-100251 was published Oct 1, 2026
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs Moderate
CVE-2026-102904 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
Budibase through 3.41.0 contains a server-side request forgery vulnerability in AI table... High Unreviewed
CVE-2026-103757 was published Oct 1, 2026
Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in... Moderate Unreviewed
CVE-2026-103291 was published Oct 1, 2026
Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the... Moderate Unreviewed
CVE-2026-103287 was published Oct 1, 2026
Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor... High Unreviewed
CVE-2026-103082 was published Oct 1, 2026
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration Moderate Unreviewed
CVE-2026-103497 was published Oct 1, 2026
A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function... Low Unreviewed
CVE-2026-103542 was published Oct 1, 2026
A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the... Moderate Unreviewed
CVE-2026-103530 was published Oct 1, 2026
Astro: Netlify Image CDN allowlist bypass enables SSRF Moderate
CVE-2026-102983 was published for @astrojs/netlify (npm) Sep 30, 2026
pacocartones Credited to pacocartones
OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in... Moderate Unreviewed
CVE-2026-101883 was published Sep 30, 2026
iDocView contains a server-side request forgery vulnerability in its /doc/upload endpoint that... High Unreviewed
CVE-2023-54402 was published Sep 30, 2026
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters Moderate
CVE-2026-84377 was published for litellm (pip) Sep 30, 2026
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials Moderate Unreviewed
CVE-2026-100279 was published Sep 30, 2026
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF... Moderate Unreviewed
CVE-2026-100257 was published Sep 30, 2026
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal... Moderate Unreviewed
CVE-2026-103243 was published Sep 30, 2026
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls High
CVE-2026-101898 was published for axios (npm) Sep 30, 2026
HamdaanAliQuatil Credited to HamdaanAliQuatil
A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL... Moderate Unreviewed
CVE-2026-102577 was published Sep 30, 2026
The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of... Moderate Unreviewed
CVE-2026-97316 was published Sep 30, 2026
PyJWT: PyJWKClient follows redirects when fetching JWKS High
CVE-2026-102267 was published for PyJWT (pip) Sep 29, 2026
NovaHunter06 Credited to NovaHunter06
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check... Low Unreviewed
CVE-2026-102877 was published Sep 29, 2026
ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the... Moderate Unreviewed
CVE-2026-102879 was published Sep 29, 2026
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can... Moderate Unreviewed
CVE-2026-100297 was published Sep 29, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database