GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
10 advisories
CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources
Moderate
GHSA-9mqm-qcwf-5qhg
was published
for
credsweeper
(pip)
Jul 10, 2026
Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation
High
GHSA-j9gf-vw2f-9hrw
was published
for
com.appsmith:server
(Maven)
Jun 12, 2026
yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
High
CVE-2026-42089
was published
for
yeoman-environment
(npm)
May 26, 2026
NocoDB: Shared-base link access can invite arbitrary users as persistent base members
Moderate
CVE-2026-46552
was published
for
nocodb
(npm)
May 21, 2026
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
Moderate
CVE-2026-46383
was published
for
apm-cli
(pip)
May 15, 2026
Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
High
CVE-2026-44641
was published
for
apm-cli
(pip)
May 7, 2026
container: pf Rule Injection via Domain Name Argument in `container system dns create --localhost` Command
Low
GHSA-39g5-644c-qwcg
was published
for
github.com/apple/container
(Swift)
May 7, 2026
listmonk's active sessions remain valid after password reset and password change
High
CVE-2026-34828
was published
for
github.com/knadh/listmonk
(Go)
Apr 1, 2026
python-ecdsa: Denial of Service via improper DER length validation in crafted private keys
Moderate
CVE-2026-33936
was published
for
ecdsa
(pip)
Mar 27, 2026
Stored XSS in Memray-generated HTML reports via unescaped command-line metadata
Low
CVE-2026-32722
was published
for
memray
(pip)
Mar 16, 2026
ProTip!
Advisories are also available from the
GraphQL API