Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

122 advisories

Loading
Apache FreeMarker template loading mechanism vulnerable to path traversal Critical
CVE-2026-84939 was published for org.freemarker:freemarker (Maven) Sep 10, 2026
oscerd Credited to oscerd and hypoflex hypoflex hypoflex
Apache Spark History Server allows stored cross-site scripting through unescaped application names Moderate
CVE-2026-32773 was published for org.apache.spark:spark-core_2.12 (Maven) Sep 2, 2026
oscerd Credited to oscerd
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Critical
CVE-2026-65905 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Critical
CVE-2026-65182 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Critical
CVE-2026-68525 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes Critical
CVE-2026-78329 was published for org.apache.camel:camel-undertow (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled Moderate
CVE-2026-59230 was published for org.apache.camel:camel-mail (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy Moderate
CVE-2026-63621 was published for org.apache.camel:camel-knative (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir Moderate
CVE-2026-60093 was published for org.apache.camel:camel-azure-storage-datalake (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted High
CVE-2026-66908 was published for org.apache.camel:camel-platform-http-main (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir Critical
CVE-2026-66906 was published for org.apache.camel:camel-azure-storage-blob (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result High
CVE-2026-66907 was published for org.apache.camel:camel-google-storage (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace Critical
CVE-2026-71300 was published for org.apache.camel:camel-atmosphere-websocket (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Airflow Task SDK fails to mask list-shaped JSON Variables Moderate
CVE-2026-68970 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow missing team context permits cross-team Dag actions and XCom reads Moderate
CVE-2026-68971 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext Moderate
CVE-2026-68969 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables Moderate
CVE-2026-54183 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow XCom API permits unsafe deserialization through JSON string literals Moderate
CVE-2026-59242 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the scheduler High
CVE-2026-67587 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow Config API exposes team-scoped sensitive configuration values Moderate
CVE-2026-65017 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow environment-variable secrets backend permits cross-team credential use Moderate
CVE-2026-68076 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypass High
CVE-2026-68968 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargs High
CVE-2026-67260 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow exception-node deserialization permits arbitrary callable execution High
CVE-2026-58076 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow exposes dict-valued var.json secrets in Rendered Templates Moderate
CVE-2026-59244 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database