Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

557 advisories

Loading
SurrealDB has Denial of Service in JSON parser due to nested objects High
CVE-2026-63760 was published for surrealdb (Rust) Jul 1, 2026
DarkaMaul Credited to DarkaMaul
Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects High
GHSA-m464-hj36-96vx was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
Duplicate Advisory: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level High
GHSA-4f9v-jpx9-mjvw was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
Duplicate Advisory: SurrealDB: Graph traversal bypasses table SELECT permissions High
GHSA-4q5r-gwcx-24m9 was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path High
CVE-2026-63735 was published for surrealdb (Rust) Sep 4, 2026
sondt99 Credited to sondt99
Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path High
GHSA-3f6w-45q9-v69m was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
Duplicate Advisory: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users High
GHSA-j6mj-v752-pp4x was published for surrealdb (Rust) Jul 20, 2026 • withdrawn
Uncaught Exception processing HTTP Headers in SurrealDB High
CVE-2024-58368 was published for surrealdb (Rust) Jan 18, 2024
Tu0Laj1 Credited to Tu0Laj1
Duplicate Advisory: Uncaught Exception processing HTTP Headers in SurrealDB High
GHSA-f7q6-7rq9-3phx was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
SurrealDB: Improper Authorization in Select Permissions High
CVE-2024-58367 was published for surrealdb (Rust) Oct 8, 2024
5hanth Credited to 5hanth and Xkonti Xkonti Xkonti
Duplicate Advisory: Improper Authorization in Select Permissions High
GHSA-j9rh-f527-3x87 was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
Duplicate Advisory: Untrusted Query Object Evaluation in RPC API High
CVE-2024-58362 was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
SurrealDB: Full Table Permissions by Default High
CVE-2023-54366 was published for surrealdb (Rust) Dec 15, 2023
LucyEgan Credited to LucyEgan
Duplicate Advisory: Full Table Permissions by Default High
GHSA-m8pp-qc66-6pgp was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository High
CVE-2026-75911 was published for codewhale (npm) Sep 4, 2026
sondt99 Credited to sondt99 and dungNHVhust dungNHVhust dungNHVhust
CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE) High
CVE-2026-75858 was published for codewhale (npm) Sep 4, 2026
sai-sh Credited to sai-sh
CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval High
CVE-2026-75912 was published for codewhale (npm) Sep 4, 2026
0xEr3n Credited to 0xEr3n
CodeWhale: js_execution leaks parent environment to model context via missing env scrub High
CVE-2026-75915 was published for codewhale (npm) Sep 4, 2026
fg0x0 Credited to fg0x0
CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval High
CVE-2026-75913 was published for codewhale (npm) Sep 4, 2026
0xEr3n Credited to 0xEr3n
CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation) High
CVE-2026-75857 was published for codewhale (npm) Sep 4, 2026
sai-sh Credited to sai-sh
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository High
CVE-2026-75859 was published for codewhale (npm) Sep 4, 2026
sondt99 Credited to sondt99, dungNHVhust, and sai-sh dungNHVhust dungNHVhust
sai-sh sai-sh
CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes High
CVE-2026-75914 was published for codewhale (npm) Sep 4, 2026
fg0x0 Credited to fg0x0
Duplicate Advisory: Uncaught Exception in Macro Expecting Native Function to Exist High
GHSA-9qjc-q7hw-vw5r was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
datadog-opentelemetry has unbounded W3C tracestate parsing that may lead to DoS High
CVE-2026-54788 was published for datadog-opentelemetry (Rust) Aug 28, 2026
Deno has an incomplete fix for command-injection prevention on Windows — case-insensitive extension bypass High
CVE-2026-22864 was published for deno (Rust) Jan 16, 2026
SharokhAtaie Credited to SharokhAtaie and B14CKSPID3R B14CKSPID3R B14CKSPID3R
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database