Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,590
Rust
22

37,604 advisories

Loading
isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS) Moderate
CVE-2026-63475 was published for isomorphic-git (npm) Nov 9, 2026
spiceoverflow Credited to spiceoverflow
isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE) High
CVE-2026-63395 was published for isomorphic-git (npm) Nov 9, 2026
spiceoverflow Credited to spiceoverflow
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator Critical
CVE-2026-63471 was published for fastapi-code-generator (pip) Nov 9, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict Critical
CVE-2026-63469 was published for fastapi-code-generator (pip) Nov 9, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring Critical
CVE-2026-63470 was published for fastapi-code-generator (pip) Nov 9, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
zt-zip: Path traversal in fluent API unpack High
CVE-2026-63436 was published for org.zeroturnaround:zt-zip (Maven) Nov 9, 2026
czTangt Credited to czTangt
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted High
CVE-2026-63417 was published for loggingredactor (pip) Nov 9, 2026
LXD has restricted project bypass leading to arbitrary command execution Critical
GHSA-47w9-6r3f-938g was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has project restriction bypass for custom volume copy across projects High
GHSA-7mr3-28h5-m5vx was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has project restriction bypass in instance copy across projects High
GHSA-qx75-2p3r-pwm5 was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
GeoNode has Stored XSS in Documents metadata abstract field Moderate
CVE-2026-55649 was published for GeoNode (pip) Nov 6, 2026
GeoNode has Unrestricted File Upload Moderate
CVE-2026-46429 was published for GeoNode (pip) Nov 6, 2026
f00bar10 Credited to f00bar10
GeoNode has OS command injection via uploaded file layer name High
CVE-2026-33050 was published for GeoNode (pip) Nov 6, 2026
ByamB4 Credited to ByamB4
LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at Moderate
CVE-2026-9639 was published for github.com/canonical/lxd (Go) Nov 6, 2026
tonghuaroot Credited to tonghuaroot
LXD has arbitrary file write on client due to trusted image hash Critical
GHSA-pjff-c2wc-f6jm was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has argument injection in backup compression algorithm leading to AFW and ACE Critical
GHSA-fmc8-p6q7-75cc was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image Critical
GHSA-vghh-5rfx-xhq8 was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has arbitrary file read+write on host via templates/ symlink in malicious image Critical
GHSA-jpf8-86f3-wp38 was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has arbitrary file write on host via `exec-output` symlink in crafted image Critical
GHSA-9j25-mm2h-2f76 was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD: SSRF via image import from URL allows internal network probing by authenticated users Moderate
CVE-2026-28385 was published for github.com/canonical/lxd (Go) Nov 6, 2026
Gyde04 Credited to Gyde04
listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials Moderate
CVE-2026-62361 was published for github.com/knadh/listmonk (Go) Nov 6, 2026
Razielx64 Credited to Razielx64
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy High
CVE-2026-62284 was published for github.com/osac-project/osac-operator (Go) Nov 6, 2026
Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration Moderate
CVE-2026-16454 was published for org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) Nov 6, 2026
Santoshkumarpuppala Credited to Santoshkumarpuppala and avgustinmm avgustinmm avgustinmm
filecoin-pin: Unbounded DAG pinning can exhaust server resources Moderate
CVE-2026-62300 was published for filecoin-pin (npm) Nov 5, 2026
Kairos-T Credited to Kairos-T
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE High
CVE-2026-61536 was published for banks (pip) Nov 5, 2026
aslein1413-sys Credited to aslein1413-sys
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database