8000 GitHub Advisory Database · GitHub
[go: up one dir, main page]
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

37,597 advisories

Loading
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker Moderate
CVE-2026-112939 was published for filelock (pip) Oct 28, 2026
filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker Low
CVE-2026-112912 was published for filelock (pip) Oct 28, 2026
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path Moderate
CVE-2026-112909 was published for filelock (pip) Oct 28, 2026
filelock: ReadWriteLock follows a symlink at the lock path into SQLite Moderate
CVE-2026-112936 was published for filelock (pip) Oct 28, 2026
Kwstubbs Credited to Kwstubbs
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses Moderate
CVE-2026-112938 was published for filelock (pip) Oct 28, 2026
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record Moderate
CVE-2026-112934 was published for filelock (pip) Oct 28, 2026
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders Moderate
CVE-2026-112935 was published for filelock (pip) Oct 28, 2026
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) Low
CVE-2026-115730 was published for i18next-http-backend (npm) Oct 28, 2026
zachariah-mithani Credited to zachariah-mithani
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing Moderate
CVE-2026-118259 was published for io.opentelemetry:opentelemetry-api (Maven) Oct 28, 2026
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML High
CVE-2026-118660 was published for happy-dom (npm) Oct 28, 2026
TharVid Credited to TharVid
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list Low
CVE-2026-118256 was published for @intlify/core (npm) Oct 28, 2026
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages High
CVE-2026-118257 was published for @intlify/core (npm) Oct 28, 2026
lissy93 Credited to lissy93 and NotAFlightRisk NotAFlightRisk NotAFlightRisk
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies Moderate
CVE-2026-118661 was published for happy-dom (npm) Oct 28, 2026
cruzryan Credited to cruzryan
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests Moderate
CVE-2026-118667 was published for langgraph (pip) Oct 28, 2026
Evelynkaz Credited to Evelynkaz
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications High
CVE-2026-118665 was published for @graphql-tools/executor-legacy-ws (npm) Oct 28, 2026
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller Moderate
CVE-2026-118666 was published for @graphql-tools/executor-legacy-ws (npm) Oct 28, 2026
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths Moderate
CVE-2026-118663 was published for @hono/node-server (npm) Oct 28, 2026
manop55555 Credited to manop55555
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers Moderate
CVE-2026-118657 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
sergeykochanov Credited to sergeykochanov, bugbunny-research, and lalalala5678 bugbunny-research bugbunny-research
lalalala5678 lalalala5678
Echo static file middleware route protection bypass via encoded dot-dot traversal Moderate
CVE-2026-118654 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
DavidCarliez Credited to DavidCarliez and kta1kri kta1kri kta1kri
Echo has a Static Middleware Double-Unescape Path Traversal Moderate
CVE-2026-118655 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI Moderate
CVE-2026-118656 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
zerovulnlabs Credited to zerovulnlabs
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto Moderate
CVE-2026-118658 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
Den-Sec Credited to Den-Sec
Highcharts Grid: `javascript:` URL in credits.href runs script on click High
CVE-2026-118255 was published for @highcharts/dashboards (npm) Oct 28, 2026
Highcharts Grid parses pagination language options as HTML High
CVE-2026-118254 was published for @highcharts/grid-lite (npm) Oct 28, 2026
Highcharts Dashboards parses fullscreen labels as HTML High
CVE-2026-118253 was published for @highcharts/dashboards (npm) Oct 28, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database
0