Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

36,911 advisories

Loading
Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability Moderate
CVE-2026-70196 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability Critical
CVE-2026-105016 was published for Microsoft.Native.Quic.MsQuic.Schannel (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability High
CVE-2026-70181 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability High
CVE-2026-70175 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability High
CVE-2026-70159 was published for Microsoft.AspNetCore.SignalR.Common (NuGet) Oct 13, 2026
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted High
GHSA-m687-p538-r5hp was published for code.vikunja.io/api (Go) Oct 9, 2026
arthurscchan Credited to arthurscchan and AdamKorcz AdamKorcz AdamKorcz
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check Moderate
GHSA-fmmf-xq98-g327 was published for code.vikunja.io/api (Go) Oct 9, 2026
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) Moderate
GHSA-pjr3-86v4-5p7w was published for code.vikunja.io/api (Go) Oct 9, 2026
Viv3kGupt4 Credited to Viv3kGupt4
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed Moderate
GHSA-hjx8-qv73-f7cm was published for code.vikunja.io/api (Go) Oct 9, 2026
euriconicacio Credited to euriconicacio and Tan-JunWei Tan-JunWei Tan-JunWei
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants Moderate
GHSA-fprf-r6rv-xg99 was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes Moderate
GHSA-4hv6-xc92-j86g was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage High
CVE-2026-107805 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
lujiefsi Credited to lujiefsi
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout Moderate
CVE-2026-107804 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
lujiefsi Credited to lujiefsi
Tina: Code injection via unescaped Git branch name in generated client source High
CVE-2026-108259 was published for @tinacms/cli (npm) Oct 9, 2026
canhieu Credited to canhieu
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment Critical
CVE-2026-108261 was published for @tinacms/app (npm) Oct 9, 2026
sondt99 Credited to sondt99
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS High
CVE-2026-108260 was published for @tinacms/web-components (npm) Oct 9, 2026
sondt99 Credited to sondt99 and iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team
Shiny for Python has path traversal in bookmark restore Moderate
CVE-2026-108258 was published for shiny (pip) Oct 9, 2026
0xRenSec Credited to 0xRenSec
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal Low
GHSA-w2ch-4xgr-22ww was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint Moderate
GHSA-8wvg-r2j4-3737 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: Cross-project task disclosure through subtask expansion Moderate
GHSA-3hc7-r24j-rpwc was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien and JellowBeanz26 JellowBeanz26 JellowBeanz26
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID Moderate
GHSA-g38j-7v97-x298 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled Moderate
CVE-2026-107842 was published for contao/core-bundle (Composer) Oct 9, 2026
iRevivalx Credited to iRevivalx
Contao: The registration module re-sends activation mails Moderate
CVE-2026-107843 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Cross-site request forgery in custom backend actions Low
CVE-2026-107848 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Path traversal in the images controller Moderate
CVE-2026-107844 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database