8000 GitHub Advisory Database · GitHub
[go: up one dir, main page]
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

37,587 advisories

Loading
LXD has arbitrary file read+write on host via templates/ symlink in malicious image Critical
GHSA-jpf8-86f3-wp38 was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has arbitrary file write on host via `exec-output` symlink in crafted image Critical
GHSA-9j25-mm2h-2f76 was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD: SSRF via image import from URL allows internal network probing by authenticated users Moderate
CVE-2026-28385 was published for github.com/canonical/lxd (Go) Nov 6, 2026
Gyde04 Credited to Gyde04
listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials Moderate
CVE-2026-62361 was published for github.com/knadh/listmonk (Go) Nov 6, 2026
Razielx64 Credited to Razielx64
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy High
CVE-2026-62284 was published for github.com/osac-project/osac-operator (Go) Nov 6, 2026
Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration Moderate
CVE-2026-16454 was published for org.eclipse.hawkbit:hawkbit-ddi-resource (Maven) Nov 6, 2026
Santoshkumarpuppala Credited to Santoshkumarpuppala and avgustinmm avgustinmm avgustinmm
filecoin-pin: Unbounded DAG pinning can exhaust server resources Moderate
CVE-2026-62300 was published for filecoin-pin (npm) Nov 5, 2026
Kairos-T Credited to Kairos-T
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE High
CVE-2026-61536 was published for banks (pip) Nov 5, 2026
aslein1413-sys Credited to aslein1413-sys
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts Critical
CVE-2026-105769 was published for github.com/chainguard-dev/kaniko (Go) Nov 5, 2026
mzihlmann Credited to mzihlmann, 8none1, and sergiodj 8none1 8none1
sergiodj sergiodj
lxd allows Cross-guest volume hijack via DevLXD device patch High
CVE-2026-12411 was published for github.com/canonical/lxd (Go) Nov 5, 2026
larrasket Credited to larrasket
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 Moderate
CVE-2026-55098 was published for github.com/basekick-labs/arc (Go) Nov 4, 2026
anir0y Credited to anir0y
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter Moderate
CVE-2026-93363 was published for @payloadcms/storage-vercel-blob (npm) Nov 4, 2026
wsparks-vc Credited to wsparks-vc
odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values Moderate
CVE-2026-113787 was published for odf-kit (npm) Nov 4, 2026
PethuKannan Credited to PethuKannan
Stanza: RCE via pickle deserialization in the lemmatizer High
CVE-2026-115878 was published for stanza (pip) Nov 3, 2026
lexdotdev Credited to lexdotdev
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access Critical
CVE-2026-44267 was published for @enspirit/elo (npm) Nov 3, 2026
ultra-supara Credited to ultra-supara
Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels Critical
CVE-2026-44266 was published for @enspirit/elo (npm) Nov 3, 2026
ultra-supara Credited to ultra-supara
Elo backends have code injection via unvalidated emission of programmatic AST fields High
CVE-2026-44265 was published for @enspirit/elo (npm) Nov 3, 2026
ultra-supara Credited to ultra-supara
Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability High
GHSA-p3jp-9v83-76w9 was published for Microsoft.DotNet.ILCompiler (NuGet) Nov 3, 2026
praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection) High
CVE-2026-62331 was published for github.com/mtzanidakis/praktor (Go) Nov 3, 2026
tonghuaroot Credited to tonghuaroot
Keycloak has authentication bypass via jwt algorithm confusion High
CVE-2026-11800 was published for org.keycloak:keycloak-services (Maven) Nov 3, 2026
Netfoil doesn't decrement TTL Moderate
GHSA-9ppr-wfw9-xvr2 was published for github.com/tinfoil-factory/netfoil (Go) Nov 3, 2026
stigtsp Credited to stigtsp
Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution High
CVE-2026-62848 was published for Metalama.Framework (NuGet) Nov 3, 2026
Arc has unauthenticated application log disclosure via `/api/v1/logs` Low
GHSA-m3qr-fvp4-78xj was published for github.com/basekick-labs/arc (Go) Nov 3, 2026
sondt99 Credited to sondt99
DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation Moderate
GHSA-j656-3hf2-fvjc was published for @bytebase/dbhub (npm) Nov 2, 2026
canolgun Credited to canolgun
SD JWT JS: Tampered disclosures silently dropped instead of rejected High
CVE-2026-62374 was published for @sd-jwt/core (npm) Nov 2, 2026
tyche-dev Credited to tyche-dev
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database
0