Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,741
Maven
5,000+
npm
5,000+
NuGet
1,116
pip
5,000+
Pub
13
RubyGems
1,152
Rust
1,570
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

45 advisories

Loading
Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled Moderate
CVE-2026-59230 was published for org.apache.camel:camel-mail (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy Moderate
CVE-2026-63621 was published for org.apache.camel:camel-knative (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir Moderate
CVE-2026-60093 was published for org.apache.camel:camel-azure-storage-datalake (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit Moderate
CVE-2026-66053 was published for thrift (pip) Jul 27, 2026
carlosfunk Credited to carlosfunk and oscerd oscerd oscerd
Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body Moderate
CVE-2026-56139 was published for org.apache.camel:camel-undertow (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter Moderate
CVE-2026-48206 was published for org.apache.camel:camel-jira (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body Moderate
CVE-2026-49365 was published for org.apache.camel:camel-netty-http (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter Moderate
CVE-2026-49098 was published for org.apache.camel:camel-kafka (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter Moderate
CVE-2026-49097 was published for org.apache.camel:camel-irc (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter Moderate
CVE-2026-49099 was published for org.apache.camel:camel-salesforce (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers Moderate
CVE-2026-49086 was published for org.apache.camel:camel-dapr (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation Moderate
CVE-2026-46453 was published for org.apache.camel:camel-elasticsearch-rest-client (Maven) Jul 6, 2026
oscerd Credited to oscerd
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class Moderate
CVE-2026-40180 was published for io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven) Apr 8, 2026
oscerd Credited to oscerd and ricardozanini ricardozanini ricardozanini
Apache SkyWalking has a stored XSS vulnerability Moderate
CVE-2025-54057 was published for org.apache.skywalking:apm-webapp (Maven) Nov 27, 2025
oscerd Credited to oscerd
Apache Answer: Avatar URL leaked user email addresses Moderate
CVE-2024-40761 was published for github.com/apache/incubator-answer (Go) Sep 25, 2024
oscerd Credited to oscerd
Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files Moderate
CVE-2024-41178 was published for object_store (Rust) Jul 23, 2024
oscerd Credited to oscerd
Apache RocketMQ Vulnerable to Unauthorized Exposure of Sensitive Data Moderate
CVE-2024-23321 was published for org.apache.rocketmq:rocketmq-all (Maven) Jul 22, 2024
oscerd Credited to oscerd
Apache Hive Code Injection vulnerability Moderate
CVE-2023-35701 was published for org.apache.hive:hive-jdbc (Maven) May 3, 2024
oscerd Credited to oscerd
Apache Zeppelin: LDAP search filter query Injection Vulnerability Moderate
CVE-2024-31867 was published for org.apache.zeppelin:zeppelin-server (Maven) Apr 9, 2024
oscerd Credited to oscerd
Apache Zeppelin vulnerable to cross-site scripting in the helium module Moderate
CVE-2024-31868 was published for org.apache.zeppelin:zeppelin-interpreter (Maven) Apr 9, 2024
oscerd Credited to oscerd
Apache Zeppelin: Cron arbitrary user impersonation with improper privileges Moderate
CVE-2024-31865 was published for org.apache.zeppelin:zeppelin-server (Maven) Apr 9, 2024
oscerd Credited to oscerd
Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints Moderate
CVE-2024-29834 was published for org.apache.pulsar:pulsar-broker (Maven) Apr 2, 2024
oscerd Credited to oscerd
Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree Moderate
CVE-2024-29133 was published for org.apache.commons:commons-configuration2 (Maven) Mar 21, 2024
oscerd Credited to oscerd
Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() Moderate
CVE-2024-29131 was published for org.apache.commons:commons-configuration2 (Maven) Mar 21, 2024
oscerd Credited to oscerd
Apache Airflow: Ignored Airflow Permission Moderate
CVE-2024-28746 was published for apache-airflow (pip) Mar 14, 2024
oscerd Credited to oscerd
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database