Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

7,186 advisories

Loading
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints Critical
CVE-2026-47892 was published for org.springframework:spring-webflux (Maven) Aug 27, 2026
Spring Framework Improper Path Limitation in XsltView Critical
CVE-2026-47884 was published for org.springframework:spring-webmvc (Maven) Aug 27, 2026
julianladisch Credited to julianladisch
Spring Framework Server Sent Event stream corruption while rendering fragments Critical
CVE-2026-47890 was published for org.springframework:spring-webflux (Maven) Aug 27, 2026
AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore Moderate
CVE-2026-55688 was published for org.asynchttpclient:async-http-client (Maven) Aug 26, 2026
IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries High
CVE-2026-54550 was published for org.codehaus.izpack:izpack-installer (Maven) Aug 26, 2026
sectroyer Credited to sectroyer
http4s has HTTP/2 Denial of Service with Ember Backend High
CVE-2026-54556 was published for org.http4s:http4s-ember-core_2.12 (Maven) Aug 26, 2026
reardonj Credited to reardonj and rossabaker rossabaker rossabaker
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Critical
CVE-2026-65905 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Critical
CVE-2026-65182 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Critical
CVE-2026-68525 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Sakai Profile Image Deletion has an IDOR Moderate
CVE-2026-54050 was published for org.sakaiproject.profile2:profile2-api (Maven) Aug 24, 2026
geo-chen Credited to geo-chen and ottenhoff ottenhoff ottenhoff
Sakai Conversations has a Stored XSS Issue High
CVE-2026-54049 was published for org.sakaiproject.conversations:sakai-conversations-impl (Maven) Aug 24, 2026
geo-chen Credited to geo-chen and ottenhoff ottenhoff ottenhoff
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes Critical
CVE-2026-78329 was published for org.apache.camel:camel-undertow (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled Moderate
CVE-2026-59230 was published for org.apache.camel:camel-mail (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy Moderate
CVE-2026-63621 was published for org.apache.camel:camel-knative (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir Moderate
CVE-2026-60093 was published for org.apache.camel:camel-azure-storage-datalake (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted High
CVE-2026-66908 was published for org.apache.camel:camel-platform-http-main (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir Critical
CVE-2026-66906 was published for org.apache.camel:camel-azure-storage-blob (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result High
CVE-2026-66907 was published for org.apache.camel:camel-google-storage (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace Critical
CVE-2026-71300 was published for org.apache.camel:camel-atmosphere-websocket (Maven) Aug 24, 2026
oscerd Credited to oscerd
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers Critical
CVE-2026-76904 was published for org.geotools.jdbc:gt-jdbc-postgis (Maven) Aug 21, 2026
qquang Credited to qquang, mrlihd, PhilipPhil, Quikko, jodygarnett, h1ei1, and 4ra1n mrlihd mrlihd
PhilipPhil PhilipPhil Quikko Quikko jodygarnett jodygarnett h1ei1 h1ei1 4ra1n 4ra1n
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding High
CVE-2026-63202 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
Pig-Tail Credited to Pig-Tail
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields High
CVE-2026-61827 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary High
CVE-2026-63124 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
sondt99 Credited to sondt99 and VuiVeIshere VuiVeIshere VuiVeIshere
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash Moderate
CVE-2026-61799 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
sondt99 Credited to sondt99
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages High
CVE-2026-61798 was published for io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (Maven) Aug 20, 2026
sondt99 Credited to sondt99
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database