Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.

29,923 advisories

Loading
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is... Critical Unreviewed
CVE-2026-83627 was published Sep 5, 2026
The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in... Critical Unreviewed
CVE-2026-13447 was published Sep 5, 2026
Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an... Critical Unreviewed
CVE-2026-75925 was published Sep 5, 2026
A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and... Critical Unreviewed
CVE-2026-81939 was published Sep 4, 2026
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')... Critical Unreviewed
CVE-2026-78327 was published Sep 4, 2026
A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem... Critical Unreviewed
CVE-2026-78328 was published Sep 4, 2026
Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server... Critical Unreviewed
CVE-2026-9317 was published Sep 4, 2026
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users... Critical Unreviewed
CVE-2026-31020 was published Sep 4, 2026
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer... Critical Unreviewed
CVE-2026-75430 was published Sep 4, 2026
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256... Critical Unreviewed
CVE-2026-75431 was published Sep 4, 2026
Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability... Critical Unreviewed
CVE-2026-44402 was published Sep 4, 2026
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via... Critical Unreviewed
CVE-2026-75160 was published Sep 4, 2026
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator... Critical Unreviewed
CVE-2026-19274 was published Sep 4, 2026
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0... Critical Unreviewed
CVE-2026-18658 was published Sep 4, 2026
TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in... Critical Unreviewed
CVE-2026-85688 was published Sep 4, 2026
LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor... Critical Unreviewed
CVE-2026-85694 was published Sep 4, 2026
SadTalker contains an OS command injection vulnerability in the video muxing process where... Critical Unreviewed
CVE-2026-85696 was published Sep 4, 2026
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that... Critical Unreviewed
CVE-2026-85695 was published Sep 4, 2026
xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook... Critical Unreviewed
CVE-2026-85667 was published Sep 4, 2026
zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where... Critical Unreviewed
CVE-2026-85672 was published Sep 4, 2026
sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain... Critical Unreviewed
CVE-2026-85625 was published Sep 4, 2026
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods... Critical Unreviewed
CVE-2026-85663 was published Sep 4, 2026
cli-mcp-server 0.2.5 contains a command allowlist bypass vulnerability in the... Critical Unreviewed
CVE-2026-85660 was published Sep 4, 2026
excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is... Critical Unreviewed
CVE-2026-85661 was published Sep 4, 2026
Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name... Critical Unreviewed
CVE-2026-85620 was published Sep 4, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database