Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,636
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,529
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

942 advisories

Loading
Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL `LIKE` pattern compiled by Janino (`LikeExpression`) Critical
CVE-2026-55565 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
Marnick39 Credited to Marnick39
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) Critical
CVE-2026-55559 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
MarkLee131 Credited to MarkLee131 and manus-use manus-use manus-use
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` Critical
CVE-2026-55511 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
Yanchon918s Credited to Yanchon918s and manus-use manus-use manus-use
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability Critical
CVE-2026-65905 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability Critical
CVE-2026-65182 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability Critical
CVE-2026-68525 was published for org.apache.tomcat.embed:tomcat-embed-core (Maven) Aug 26, 2026
oscerd Credited to oscerd
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes Critical
CVE-2026-78329 was published for org.apache.camel:camel-undertow (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace Critical
CVE-2026-71300 was published for org.apache.camel:camel-atmosphere-websocket (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir Critical
CVE-2026-66906 was published for org.apache.camel:camel-azure-storage-blob (Maven) Aug 24, 2026
oscerd Credited to oscerd
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers Critical
CVE-2026-76904 was published for org.geotools.jdbc:gt-jdbc-postgis (Maven) Aug 21, 2026
qquang Credited to qquang, mrlihd, PhilipPhil, Quikko, jodygarnett, h1ei1, and 4ra1n mrlihd mrlihd
PhilipPhil PhilipPhil Quikko Quikko jodygarnett jodygarnett h1ei1 h1ei1 4ra1n 4ra1n
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass Critical
CVE-2026-18963 was published for org.keycloak:keycloak-services (Maven) Aug 18, 2026
madmuffin1 Credited to madmuffin1, greiffmode, and pv-rudger greiffmode greiffmode
pv-rudger pv-rudger
Apache Ranger has a Command Injection vulnerability Critical
CVE-2026-28672 was published for org.apache.ranger:ranger (Maven) Aug 10, 2026
oscerd Credited to oscerd
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check Critical
CVE-2026-73644 was published for org.openidentityplatform.opendj:opendj-server-legacy (Maven) Jul 24, 2026
hypnguyen1209 Credited to hypnguyen1209
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway Critical
GHSA-68r5-9hpg-7qw9 was published for org.openidentityplatform.opendj:opendj-dsml-servlet (Maven) Jul 24, 2026
manus-use Credited to manus-use
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback Critical
CVE-2026-62379 was published for org.openidentityplatform.openam:openam-core (Maven) Jul 24, 2026
manus-use Credited to manus-use and BarakSrour BarakSrour BarakSrour
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass Critical
CVE-2026-62263 was published for org.openidentityplatform.openam:openam-auth-webauthn (Maven) Jul 24, 2026
Pig-Tail Credited to Pig-Tail, MarkLee131, baradika, manus-use, and tonghuaroot MarkLee131 MarkLee131
baradika baradika manus-use manus-use tonghuaroot tonghuaroot
fastjson has a remote code execution (RCE) vulnerability Critical
CVE-2026-16723 was published for com.alibaba:fastjson (Maven) Jul 23, 2026
dor-hayun Credited to dor-hayun, AnvithaCDhanekula, and timtebeek AnvithaCDhanekula AnvithaCDhanekula
timtebeek timtebeek
Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF) Critical
CVE-2026-48205 was published for org.apache.camel:camel-dns (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy Critical
CVE-2026-56140 was published for org.apache.camel:camel-aws2-sns (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities Critical
CVE-2026-53913 was published for org.apache.camel:camel-keycloak (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields Critical
CVE-2026-48203 was published for org.apache.camel:camel-solr (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered  gridfs.*  HTTP headers Critical
CVE-2026-48204 was published for org.apache.camel:camel-mongodb-gridfs (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers Critical
CVE-2026-46456 was published for org.apache.camel:camel-aws2-sqs (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer Critical
CVE-2026-40047 was published for org.apache.camel:camel-docling (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted Critical
CVE-2026-46455 was published for org.apache.camel:camel-keycloak (Maven) Jul 6, 2026
oscerd Credited to oscerd
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database