GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
Filter advisories
Filter advisories
GitHub reviewed advisories
All reviewed
5,000+
Composer
4,472
Erlang
33
GitHub Actions
24
Go
2,195
Maven
5,000+
npm
3,841
NuGet
696
pip
3,632
Pub
12
RubyGems
911
Rust
910
Swift
38
Unreviewed advisories
All unreviewed
5,000+
5,421 advisories
Filter by severity
Liferay Portal and Liferay DXP Reveals Data via Forms
Moderate
CVE-2025-2565
was published
for
com.liferay.portal:release.dxp.bom
(Maven)
Mar 20, 2025
Apache Druid vulnerable to Server-Side Request Forgery, Cross-site Scripting, Open Redirect
Moderate
CVE-2025-27888
was published
for
org.apache.druid:druid
(Maven)
Mar 20, 2025
H2O Vulnerable to Arbitrary File Overwrite
High
CVE-2024-8616
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request
High
CVE-2024-8062
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
High
CVE-2024-7765
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
High
CVE-2024-7768
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Vulnerable to Arbitrary File Overwrite via File Export
High
CVE-2024-6854
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Vulnerable to Execution of Arbitrary Files
Moderate
CVE-2024-6863
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
High
CVE-2024-10549
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
High
CVE-2024-10550
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Deserialization of Untrusted Data Vulnerability
Critical
CVE-2024-10553
was published
for
ai.h2o:h2o-core
(Maven)
Mar 20, 2025
H2O Vulnerable to Denial of Service (DoS) and File Write
High
CVE-2024-10572
was published
for
ai.h2o:h2o-ext-xgboost
(Maven)
Mar 20, 2025
Apache Seata Vulnerable to Deserialization of Untrusted Data
Low
CVE-2024-47552
was published
for
org.apache.seata:seata-config-core
(Maven)
Mar 20, 2025
Apache Seata Vulnerable to Data Amplification
Low
CVE-2024-54016
was published
for
org.apache.seata:seata-parent
(Maven)
Mar 20, 2025
Spring Security Does Not Enforce Password Length
High
CVE-2025-22228
was published
for
org.springframework.security:spring-security-crypto
(Maven)
Mar 20, 2025
Liferay Portal and Liferay DXP Vulnerable to Cross-Site Scripting (XSS)
Moderate
CVE-2025-2536
was published
for
com.liferay.portal:release.dxp.bom
(Maven)
Mar 19, 2025
The WikiManager REST API allows any user to create wikis
High
CVE-2025-29926
was published
for
org.xwiki.platform:xwiki-platform-wiki-rest-default
(Maven)
Mar 19, 2025
XWiki allows unregistered users to access private pages information through REST endpoint
High
CVE-2025-29925
was published
for
org.xwiki.platform:xwiki-platform-rest-server
(Maven)
Mar 19, 2025
XWiki uses the wrong wiki reference in AuthorizationManager
High
CVE-2025-29924
was published
for
org.xwiki.platform:xwiki-platform-security-authorization-api
(Maven)
Mar 19, 2025
Jenkins AnchorChain Plugin Has a Cross-Site Scripting (XSS) Vulnerability
High
CVE-2025-30196
was published
for
org.jenkins-ci.plugins:anchorchain
(Maven)
Mar 19, 2025
Jenkins Zoho QEngine Plugin Displays Unmasked API Keys
Low
CVE-2025-30197
was published
for
io.jenkins.plugins:zohoqengine
(Maven)
Mar 19, 2025
Wire has Uncontrolled Recursion on Nested Groups
Moderate
CVE-2024-58103
was published
for
com.squareup.wire:wire-runtime
(Maven)
Mar 16, 2025
Snowflake JDBC Driver client-side encryption key in DEBUG logs
Low
CVE-2025-27496
was published
for
net.snowflake:snowflake-jdbc
(Maven)
Mar 13, 2025
Ed25519 Signature Malleability in ed25519-java Due to Missing Scalar Range Check
Moderate
CVE-2020-36843
was published
for
net.i2p.crypto:eddsa
(Maven)
Mar 13, 2025
Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record
Moderate
CVE-2025-27017
was published
for
org.apache.nifi:nifi-mongodb-services
(Maven)
Mar 12, 2025
ProTip!
Advisories are also available from the
GraphQL API