Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

95 advisories

Loading
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a... High Unreviewed
CVE-2026-47852 was published Aug 27, 2026
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at... Moderate Unreviewed
CVE-2026-75920 was published Aug 19, 2026
A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider... Moderate Unreviewed
CVE-2026-73585 was published Aug 13, 2026
A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition... Moderate Unreviewed
CVE-2026-73584 was published Aug 13, 2026
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite Moderate
CVE-2026-55086 was published for ep_etherpad-lite (npm) Aug 13, 2026
A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI... Low Unreviewed
CVE-2026-16791 was published Aug 4, 2026
A vulnerability in the web-based management interface of an ECOS device could allow a highly... High Unreviewed
CVE-2026-44878 was published Jul 21, 2026
Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases Low
CVE-2026-53759 was published for linuxfabrik-lib (pip) Jul 6, 2026
OoYo0uto Credited to OoYo0uto
mktemp: empty TMPDIR creates temp files in CWD instead of /tmp Low
CVE-2026-35342 was published for uu_mktemp (Rust) Jul 6, 2026
GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file... Low Unreviewed
CVE-2026-41991 was published Jun 29, 2026
@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write Moderate
CVE-2026-46406 was published for @anthropic-ai/claude-code (npm) Jun 25, 2026
Spring Boot: Predictable Temp Directory in Artemis Auto-configuration Moderate
CVE-2026-41001 was published for org.springframework.boot:spring-boot-autoconfigure (Maven) Jun 11, 2026
CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that... High Unreviewed
CVE-2026-49134 was published Jun 1, 2026
The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12... High Unreviewed
CVE-2025-67223 was published Apr 28, 2026
Spring AI's ONNX model cache defaults to world-writable predictable /tmp directory Moderate
CVE-2026-40979 was published for org.springframework.ai:spring-ai-transformers (Maven) Apr 28, 2026
Spring Boot accepts predictable temp directory without ownership verification High
CVE-2026-40973 was published for org.springframework.boot:spring-boot (Maven) Apr 28, 2026
Duplicate Advisory: uutils coreutils' mktemp utility doesn't properly handle an empty TMPDIR environment variable Low
GHSA-2cxp-xq3c-mjxx was published for coreutils (Rust) Apr 22, 2026 • withdrawn
In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform... High Unreviewed
CVE-2026-20204 was published Apr 15, 2026
poetry-plugin-tweak-dependencies-version affected by CVE-2026-25645 Moderate
GHSA-5qvp-pr9f-2g2v was published for poetry-plugin-tweak-dependencies-version (pip) Apr 1, 2026
A vulnerability was detected in Enter Software Iperius Backup bis 8.7.3. Affected is an unknown... High Unreviewed
CVE-2026-4822 was published Mar 25, 2026
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function Moderate
CVE-2026-25645 was published for requests (pip) Mar 25, 2026
Jaycelation Credited to Jaycelation, nateprewitt, and sigmavirus24 nateprewitt nateprewitt
sigmavirus24 sigmavirus24
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in... Moderate Unreviewed
CVE-2026-20651 was published Mar 25, 2026
Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing) High
GHSA-8mpm-q7mh-8fvh was published for @capgo/cli (npm) Mar 18, 2026
Judel777 Credited to Judel777
An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create... High Unreviewed
CVE-2026-25701 was published Feb 25, 2026
An issue was addressed with improved handling of temporary files. This issue is fixed in macOS... Moderate Unreviewed
CVE-2026-20618 was published Feb 12, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database