Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

36,565 advisories

Loading
MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code... Critical Unreviewed
CVE-2026-111356 was published Oct 16, 2026
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows... Critical Unreviewed
CVE-2026-111322 was published Oct 16, 2026
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow... Critical Unreviewed
CVE-2026-111329 was published Oct 16, 2026
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass... Critical Unreviewed
CVE-2026-111283 was published Oct 16, 2026
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code... Critical Unreviewed
CVE-2026-111281 was published Oct 16, 2026
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the... Critical Unreviewed
CVE-2026-111312 was published Oct 16, 2026
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and... Critical Unreviewed
CVE-2026-105032 was published Oct 15, 2026
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The... Critical Unreviewed
CVE-2026-102764 was published Oct 15, 2026
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles... Critical Unreviewed
CVE-2026-105039 was published Oct 15, 2026
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered,... Critical Unreviewed
CVE-2026-105037 was published Oct 15, 2026
The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model... Critical Unreviewed
CVE-2026-105038 was published Oct 15, 2026
An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS... Critical Unreviewed
CVE-2026-111235 was published Oct 15, 2026
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses Critical
CVE-2026-102989 was published for @tanstack/react-start (npm) Oct 15, 2026
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation Critical
CVE-2026-94603 was published for github.com/containers/podman (Go) Oct 15, 2026
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication Critical
CVE-2026-77524 was published for github.com/kedacore/keda (Go) Oct 15, 2026
cherez0ff Credited to cherez0ff, the-vibe-dev, everping, zwindler, b0b0haha, and j311yl0v3u the-vibe-dev the-vibe-dev
everping everping zwindler zwindler b0b0haha b0b0haha j311yl0v3u j311yl0v3u
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks Critical
CVE-2026-77459 was published for github.com/argoproj/argo-cd/v2 (Go) Oct 15, 2026
RealFakeAccount Credited to RealFakeAccount, AdamKorcz, 0xshylines, thevilledev, HenriWilliams, cherez0ff, and zwindler AdamKorcz AdamKorcz
0xshylines 0xshylines thevilledev thevilledev HenriWilliams HenriWilliams cherez0ff cherez0ff zwindler zwindler
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service Critical
CVE-2026-102748 was published for github.com/dgraph-io/dgraph/v25 (Go) Oct 15, 2026
0d000721999 Credited to 0d000721999
Vitess vttablet /twopcz reflected XSS Critical
CVE-2026-104252 was published for vitess.io/vitess (Go) Oct 15, 2026
xylove21 Credited to xylove21
An unauthenticated remote attacker can bypass authentication and gain full access to... Critical Unreviewed
CVE-2026-84731 was published Oct 15, 2026
Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune... Critical Unreviewed
CVE-2026-110812 was published Oct 15, 2026
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an... Critical Unreviewed
CVE-2026-110958 was published Oct 15, 2026
A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote... Critical Unreviewed
CVE-2026-105474 was published Oct 15, 2026
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected... Critical Unreviewed
CVE-2026-110957 was published Oct 15, 2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')... Critical Unreviewed
CVE-2026-109688 was published Oct 15, 2026
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link... Critical Unreviewed
CVE-2026-109686 was published Oct 15, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database