Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,714
Maven
5,000+
npm
5,000+
NuGet
1,110
pip
5,000+
Pub
13
RubyGems
1,151
Rust
1,567
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

15 advisories

Loading
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking Moderate
CVE-2026-81888 was published for @hono/oauth-providers (npm) Aug 31, 2026
TarPeg007 Credited to TarPeg007
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies... High Unreviewed
CVE-2026-47889 was published Aug 27, 2026
AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore Moderate
CVE-2026-55688 was published for org.asynchttpclient:async-http-client (Maven) Aug 26, 2026
OpenAM Insecure SSO Cookie Initialization High
CVE-2026-53660 was published for org.openidentityplatform.openam:openam-core (Maven) Aug 14, 2026
wodzen Credited to wodzen
Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design Low
CVE-2026-8413 was published for concrete5/concrete5 (Composer) May 22, 2026
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This... Moderate Unreviewed
CVE-2025-52628 was published Feb 3, 2026
Kimai contains a SameSite cookie vulnerability High
CVE-2023-53957 was published for kimai/kimai (Composer) Dec 19, 2025
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0... Low Unreviewed
CVE-2025-36134 was published Nov 25, 2025
HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to... Moderate Unreviewed
CVE-2024-42212 was published May 5, 2025
HCL SX does not set the secure attribute on authorization tokens or session cookies. Attackers... Moderate Unreviewed
CVE-2024-30155 was published Mar 26, 2025
A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for... Moderate Unreviewed
CVE-2025-24387 was published Mar 10, 2025
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the... Low Unreviewed
CVE-2024-43173 was published Oct 22, 2024
A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies.... Critical Unreviewed
CVE-2024-6611 was published Jul 9, 2024
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite for Software 1... Moderate Unreviewed
CVE-2022-38386 was published May 1, 2024
Improper configuration in Samsung Internet prior to version 21.0.0.41 allows attacker to bypass... Moderate Unreviewed
CVE-2023-30674 was published Jul 6, 2023
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database