Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
101
GitHub Actions
54
Go
4,295
Maven
5,000+
npm
5,000+
NuGet
1,029
pip
5,000+
Pub
13
RubyGems
1,107
Rust
1,492
Swift
61
Unreviewed advisories
All unreviewed
5,000+

99 advisories

Loading
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes High
CVE-2026-55698 was published for pnpm (npm) Jun 26, 2026
pnpm: Repository-controlled configDependencies can select a pacquet native install engine High
CVE-2026-55697 was published for pnpm (npm) Jun 26, 2026
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags... High Unreviewed
CVE-2021-47986 was published Jun 26, 2026
Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version... High Unreviewed
CVE-2021-47987 was published Jun 26, 2026
Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY High
GHSA-gv7w-rqvm-qjhr was published for esbuild (npm) Jun 12, 2026 • withdrawn
sondt99 Credited to sondt99 and dungNHVhust dungNHVhust dungNHVhust
stigmem-node's unsigned plugin override could be enabled without a second explicit acknowledgment High
GHSA-w7pm-9g55-mxfm was published for stigmem-node (pip) May 29, 2026
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained... High Unreviewed
CVE-2026-9089 was published May 21, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) High
CVE-2026-42575 was published for chainguard.dev/apko (Go) May 4, 2026
1seal Credited to 1seal and antitree antitree antitree
Ollama for Windows does not perform integrity or authenticity verification of downloaded update... High Unreviewed
CVE-2026-42248 was published Apr 29, 2026
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The ... High Unreviewed
CVE-2026-40066 was published Apr 17, 2026
TrueConf Client downloads application update code and applies it without performing verification.... High Unreviewed
CVE-2026-3502 was published Mar 30, 2026
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack High
CVE-2026-28500 was published for onnx (pip) Mar 16, 2026
ZeroXJacks Credited to ZeroXJacks
Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity... High Unreviewed
CVE-2025-15556 was published Feb 3, 2026
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies High
CVE-2025-69263 was published for pnpm (npm) Jan 7, 2026
orenyomtov Credited to orenyomtov
An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before... High Unreviewed
CVE-2025-55310 was published Dec 11, 2025
An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute... High Unreviewed
CVE-2025-61228 was published Dec 1, 2025
The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure... High Unreviewed
CVE-2025-63434 was published Nov 24, 2025
The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via... High Unreviewed
CVE-2025-63220 was published Nov 19, 2025
The Sound4 IMPACT web-based management interface is vulnerable to Remote Code Execution (RCE) via... High Unreviewed
CVE-2025-63215 was published Nov 19, 2025
An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows... High Unreviewed
CVE-2025-52263 was published Oct 27, 2025
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from... High Unreviewed
CVE-2025-11493 was published Oct 16, 2025
Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.843 and... High Unreviewed
CVE-2025-34212 was published Sep 29, 2025
The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code... High Unreviewed
CVE-2025-57431 was published Sep 22, 2025
A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary... High Unreviewed
CVE-2025-9319 was published Sep 11, 2025
ECOVACS vacuum robot base stations do not validate firmware updates, so malicious over-the-air... High Unreviewed
CVE-2025-30199 was published Sep 5, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database