Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,590
Rust
22

37,604 advisories

Loading
AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers High
CVE-2026-96631 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
retkoussa Credited to retkoussa and vrana vrana vrana
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass) High
CVE-2026-96632 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass) High
CVE-2026-96630 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
vrana Credited to vrana
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery Moderate
CVE-2026-96629 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
az0mb13 Credited to az0mb13 and vrana vrana vrana
NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 Moderate
CVE-2026-54442 was published for gov.nsa.emissary:emissary (Maven) Oct 30, 2026
decsecre583 Credited to decsecre583 and ranjiGT ranjiGT ranjiGT
pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI Critical
GHSA-5xjx-3w67-w9x9 was published for pypa/gh-action-pypi-publish (GitHub Actions) Oct 30, 2026
AdminNeo: version-cache array injection causes persistent denial of service High
CVE-2026-59978 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
JoyGhoshs Credited to JoyGhoshs and vrana vrana vrana
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection Moderate
CVE-2026-119284 was published for joserfc (pip) Oct 30, 2026
ze3tar Credited to ze3tar
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption High
CVE-2026-119283 was published for joserfc (pip) Oct 30, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users Moderate
GHSA-f3fj-9625-rv3m was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories Moderate
GHSA-fgxm-5hvv-x4vh was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99 and Xiaoyiyi23 Xiaoyiyi23 Xiaoyiyi23
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options High
CVE-2026-119282 was published for @nx/gradle (npm) Oct 30, 2026
arkmarta Credited to arkmarta
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs High
CVE-2026-118664 was published for decode-uri-component (npm) Oct 29, 2026
gdegrange Credited to gdegrange
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset High
GHSA-vpp8-g58w-m8mp was published for Twisted (pip) Oct 29, 2026
arkmarta Credited to arkmarta
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size High
CVE-2026-115907 was published for zip (Rust) Oct 29, 2026
Yeaseen Credited to Yeaseen
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. High
CVE-2026-115908 was published for zip (Rust) Oct 29, 2026
sl91994 Credited to sl91994
zip: AES Entry HMAC Authentication Bypass on Premature EOF Moderate
CVE-2026-115906 was published for zip (Rust) Oct 29, 2026
secstant-sigp Credited to secstant-sigp and Its-Just-Nans Its-Just-Nans Its-Just-Nans
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction High
CVE-2026-115909 was published for zip (Rust) Oct 29, 2026
kirk-baird Credited to kirk-baird, secstant-sigp, and li-jin-quan secstant-sigp secstant-sigp
li-jin-quan li-jin-quan
Vite: `server.fs.deny` bypassed with queries Moderate
CVE-2026-118662 was published for vite (npm) Oct 29, 2026
Hama1cco Credited to Hama1cco
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps High
CVE-2026-63414 was published for shopify_app (RubyGems) Oct 29, 2026
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials High
CVE-2026-62290 was published for github.com/cert-manager/cert-manager (Go) Oct 29, 2026
kamil-sawicki Credited to kamil-sawicki, robertprast, and EQSTLab robertprast robertprast
EQSTLab EQSTLab
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass High
CVE-2026-9086 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing Moderate
CVE-2026-9083 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak allows unauthorized access to resources via uma permission ticket bypass Moderate
CVE-2026-9799 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak vulnerable to authorization bypass via incorrect uri comparison High
CVE-2026-9800 was published for org.keycloak:keycloak-policy-enforcer (Maven) Oct 29, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database