Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,508
Maven
5,000+
npm
5,000+
NuGet
1,091
pip
5,000+
Pub
13
RubyGems
1,145
Rust
1,511
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

120 advisories

Loading
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header... Moderate Unreviewed
CVE-2026-0673 was published Aug 6, 2026
rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines Moderate
CVE-2026-71311 was published for github.com/rclone/rclone (Go) Aug 5, 2026
cyberlanc3r Credited to cyberlanc3r and ncw ncw ncw
undici vulnerable to CRLF Injection via blob-like body 'type' property Moderate
CVE-2026-15157 was published for undici (npm) Aug 3, 2026
mcollina Credited to mcollina and UlisesGascon UlisesGascon UlisesGascon
Req vulnerable to multipart form-data header injection via unescaped name/filename/content_type Moderate
CVE-2026-49756 was published for req (Erlang) Jul 29, 2026
PJUllrich Credited to PJUllrich and maennchen maennchen maennchen
SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows... Moderate Unreviewed
CVE-2026-57511 was published Jul 28, 2026
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder Moderate
CVE-2026-59921 was published for io.netty:netty-codec-http (Maven) Jul 22, 2026
Netty: STOMP CONNECT Frame Header Injection in Netty Moderate
CVE-2026-59920 was published for io.netty:netty-codec-stomp (Maven) Jul 22, 2026
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address Moderate
CVE-2026-59919 was published for io.netty:netty-codec-haproxy (Maven) Jul 22, 2026
A privilege escalation vulnerability exists in the HTTP authentication component in Archer... Moderate Unreviewed
CVE-2026-15429 was published Jul 14, 2026
aiosmtplib vulnerable to SMTP command injection via CR/LF in sender/recipient address Moderate
CVE-2026-53533 was published for aiosmtplib (pip) Jul 7, 2026
tonghuaroot Credited to tonghuaroot
The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More... Moderate Unreviewed
CVE-2026-12127 was published Jul 1, 2026
Hackney has CRLF / header injection in WebSocket upgrade request Moderate
CVE-2026-47072 was published for hackney (Erlang) Jun 26, 2026
PJUllrich Credited to PJUllrich and maennchen maennchen maennchen
Hackney has CR/LF injection in query parameter Moderate
CVE-2026-47075 was published for hackney (Erlang) Jun 26, 2026
tepel-chen Credited to tepel-chen and maennchen maennchen maennchen
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization Moderate
CVE-2026-55766 was published for guzzlehttp/psr7 (Composer) Jun 19, 2026
iliaal Credited to iliaal
undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Moderate
CVE-2026-9679 was published for undici (npm) Jun 19, 2026
tndud042713 Credited to tndud042713, mcollina, KhafraDev, and UlisesGascon mcollina mcollina
KhafraDev KhafraDev UlisesGascon UlisesGascon
Kirby: Request header injection in `Http\Remote` Moderate
CVE-2026-50188 was published for getkirby/cms (Composer) Jun 18, 2026
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection Moderate
GHSA-268h-hp4c-crq3 was published for nodemailer (npm) Jun 15, 2026
sondt99 Credited to sondt99 and dungNHVhust dungNHVhust dungNHVhust
SwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator Moderate
CVE-2026-28970 was published for github.com/apple/swift-nio (Swift) Jun 12, 2026
kuranikaran Credited to kuranikaran and YLChen-007 YLChen-007 YLChen-007
guzzlehttp/psr7 has CRLF Injection via URI Host Component Moderate
CVE-2026-49214 was published for guzzlehttp/psr7 (Composer) Jun 11, 2026
edorian Credited to edorian
Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric... Moderate Unreviewed
CVE-2026-50639 was published Jun 10, 2026
Net::IMAP: Command Injection via ID command argument Moderate
CVE-2026-47242 was published for net-imap (RubyGems) Jun 9, 2026
nevans Credited to nevans
Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument Moderate
CVE-2026-47240 was published for net-imap (RubyGems) Jun 9, 2026
nevans Credited to nevans
Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not... Moderate Unreviewed
CVE-2026-46739 was published Jun 4, 2026
Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections. The metric... Moderate Unreviewed
CVE-2026-8722 was published Jun 4, 2026
Music Player Daemon (MPD) before version 0.24.11 contains a CRLF injection vulnerability in the... Moderate Unreviewed
CVE-2026-49130 was published May 28, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database