Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
102
GitHub Actions
54
Go
4,428
Maven
5,000+
npm
5,000+
NuGet
1,088
pip
5,000+
Pub
13
RubyGems
1,129
Rust
1,506
Swift
62
Unreviewed advisories
All unreviewed
5,000+

13 advisories

Loading
1Password 8 before 8.10.38 for macOS allows local attackers to exfiltrate vault items by... Moderate Unreviewed
CVE-2024-42218 was published Aug 6, 2024
`idna` accepts Punycode labels that do not produce any non-ASCII when decoded Moderate
CVE-2024-12224 was published for idna (Rust) Dec 9, 2024
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 18.8.4... Moderate Unreviewed
CVE-2026-1094 was published Feb 11, 2026
Improper input validation in the apps and endpoints configuration in PowerShell Universal before... Moderate Unreviewed
CVE-2026-3563 was published Mar 17, 2026
OpenFGA has an Authorization Bypass through cached keys Moderate
CVE-2026-33729 was published for github.com/openfga/openfga (Go) Mar 26, 2026
justincoh Credited to justincoh and saad-h1 saad-h1 saad-h1
An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows... Moderate Unreviewed
CVE-2026-22569 was published Mar 31, 2026
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes Moderate
CVE-2026-41213 was published for @node-oauth/oauth2-server (npm) Apr 16, 2026
KarimTantawey Credited to KarimTantawey, jankapunkt, and dhensby jankapunkt jankapunkt
dhensby dhensby
DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode Moderate
CVE-2026-41239 was published for dompurify (npm) Apr 22, 2026
bencalif Credited to bencalif
Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero... Moderate Unreviewed
CVE-2026-45191 was published May 10, 2026
Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask... Moderate Unreviewed
CVE-2026-45190 was published May 10, 2026
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 Moderate
CVE-2026-47674 was published for hono (npm) Jun 4, 2026
offset Credited to offset and 0xEr3n 0xEr3n 0xEr3n
Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. ... Moderate Unreviewed
CVE-2026-49940 was published Jun 4, 2026
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks Moderate
CVE-2026-48710 was published for starlette (pip) Jun 4, 2026
x41j Credited to x41j, ehhthing, and nic-lovin ehhthing ehhthing
nic-lovin nic-lovin
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database