Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,714
Maven
5,000+
npm
5,000+
NuGet
1,110
pip
5,000+
Pub
13
RubyGems
1,151
Rust
1,567
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

142 advisories

Loading
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed High
CVE-2026-83616 was published for @xmldom/xmldom (npm) Sep 8, 2026
bhaswanthc Credited to bhaswanthc and arpitjain099 arpitjain099 arpitjain099
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator High
CVE-2026-83617 was published for @xmldom/xmldom (npm) Sep 8, 2026
karfau Credited to karfau
xmldom: DocType `name` Injection Bypasses requireWellFormed High
CVE-2026-83608 was published for @xmldom/xmldom (npm) Sep 8, 2026
karfau Credited to karfau
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path High
CVE-2026-83609 was published for @xmldom/xmldom (npm) Sep 8, 2026
karfau Credited to karfau
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator High
CVE-2026-83618 was published for @xmldom/xmldom (npm) Sep 8, 2026
karfau Credited to karfau
xmldom: Element name injection via createElement() bypasses requireWellFormed High
CVE-2026-83607 was published for @xmldom/xmldom (npm) Sep 8, 2026
bhaswanthc Credited to bhaswanthc
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed High
CVE-2026-83605 was published for @xmldom/xmldom (npm) Sep 8, 2026
bhaswanthc Credited to bhaswanthc
A flaw was found in wildfly-core. A remote user authenticated as an administrative user can... Moderate Unreviewed
CVE-2026-24329 was published Aug 11, 2026
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction... Low Unreviewed
CVE-2026-15037 was published Jul 23, 2026
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields Moderate
CVE-2026-59728 was published for @astrojs/rss (npm) Jul 20, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator Moderate
CVE-2026-53723 was published for guzzlehttp/guzzle-services (Composer) Jun 11, 2026
GrahamCampbell Credited to GrahamCampbell
Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote... High Unreviewed
CVE-2026-11169 was published Jun 5, 2026
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions High
CVE-2026-46490 was published for samlify (npm) May 21, 2026
RootUp Credited to RootUp
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes High
CVE-2026-44665 was published for fast-xml-builder (npm) May 8, 2026
amitguptagwl Credited to amitguptagwl
fast-xml-builder Comment Value regex can be bypassed Moderate
CVE-2026-44664 was published for fast-xml-builder (npm) May 8, 2026
amitguptagwl Credited to amitguptagwl
Kirby has XML injection in its XML creator toolkit Moderate
CVE-2026-32870 was published for getkirby/cms (Composer) Apr 23, 2026
dapatrese Credited to dapatrese
xmldom has XML injection through unvalidated DocumentType serialization High
CVE-2026-41674 was published for @xmldom/xmldom (npm) Apr 22, 2026
TharVid Credited to TharVid
xmldom has XML node injection through unvalidated processing instruction serialization High
CVE-2026-41675 was published for @xmldom/xmldom (npm) Apr 22, 2026
tlsbollei Credited to tlsbollei and TharVid TharVid TharVid
xmldom has XML node injection through unvalidated comment serialization High
CVE-2026-41672 was published for @xmldom/xmldom (npm) Apr 22, 2026
Jvr2022 Credited to Jvr2022 and TharVid TharVid TharVid
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters Moderate
CVE-2026-41650 was published for fast-xml-parser (npm) Apr 22, 2026
TharVid Credited to TharVid
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion High
CVE-2026-34601 was published for @xmldom/xmldom (npm) Apr 1, 2026
thesmartshadow Credited to thesmartshadow and karfau karfau karfau
Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in... Moderate Unreviewed
CVE-2026-28770 was published Mar 4, 2026
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System ... Moderate Unreviewed
CVE-2026-1554 was published Feb 4, 2026
Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the FSService that... High Unreviewed
CVE-2022-50902 was published Jan 14, 2026
An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated... High Unreviewed
CVE-2025-1545 was published Dec 5, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database