Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

2,060 advisories

Loading
SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password Moderate
CVE-2026-72792 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 4, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Tag labels from password-protected documents are returned to readers who have not entered the password Moderate
GHSA-f68g-4xv8-2g75 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers Moderate
CVE-2026-72796 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 4, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers Moderate
GHSA-cm9f-w4h4-7j85 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers Moderate
CVE-2026-72797 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 4, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: getEncryptedNotebookStatus discloses names and live unlock state of all encrypted notebooks to anonymous readers Moderate
GHSA-rchc-g58m-88jm was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers Moderate
CVE-2026-72799 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 4, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers Moderate
GHSA-v3v5-7j3j-cc6f was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) Moderate
CVE-2026-72800 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) Moderate
GHSA-fxmw-rv85-5hwh was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath Moderate
CVE-2026-72802 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Absolute filesystem path and OS username disclosure via resolveAssetPath Moderate
GHSA-72xp-24p9-7vpf was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents Moderate
CVE-2026-72803 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents Moderate
GHSA-h4w7-mgq4-wg6x was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents Moderate
CVE-2026-72805 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents Moderate
GHSA-89hf-xcx5-r9r6 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) Moderate
CVE-2026-72806 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) Moderate
GHSA-j26h-r8jx-887c was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode) Moderate
CVE-2026-72808 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode) Moderate
GHSA-mhcc-g592-267j was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) Moderate
CVE-2026-72812 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) Moderate
GHSA-ww86-c2qf-w8fw was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 14, 2026 • withdrawn
SiYuan: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered Moderate
CVE-2026-68585 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Cross-boundary metadata disclosure via getBlockInfo (publish mode): reader-reachable document title/root info for publish-forbidden docs; sibling getDocInfo is filtered Moderate
GHSA-3rfw-7fxw-6jxm was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 3, 2026 • withdrawn
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root Moderate
CVE-2026-61625 was published for github.com/VictoriaMetrics/VictoriaMetrics (Go) Sep 3, 2026
sondt99 Credited to sondt99, dungNHVhust, arkid15r, and makasim dungNHVhust dungNHVhust
arkid15r arkid15r makasim makasim
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database