Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,581
Rust
21

454 advisories

Loading
Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated... High Unreviewed
CVE-2026-89036 was published Sep 17, 2026
Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user... High Unreviewed
CVE-2026-76866 was published Sep 16, 2026
Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the... High Unreviewed
CVE-2026-76862 was published Sep 16, 2026
An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia... High Unreviewed
CVE-2026-43698 was published Jul 27, 2026
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection... High Unreviewed
CVE-2026-19624 was published Sep 14, 2026
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server... Low Unreviewed
CVE-2023-22632 was published Sep 14, 2026
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML... Low Unreviewed
CVE-2023-22631 was published Sep 14, 2026
aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing... Moderate Unreviewed
CVE-2026-90467 was published Sep 12, 2026
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability... Low Unreviewed
CVE-2026-11765 was published Sep 11, 2026
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin... Critical Unreviewed
CVE-2026-86060 was published Sep 5, 2026
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an... Moderate Unreviewed
CVE-2026-0304 was published Sep 10, 2026
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')... High Unreviewed
CVE-2026-8044 was published Sep 9, 2026
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip... High Unreviewed
CVE-2026-87794 was published Sep 9, 2026
The Okta Privileged Access client URL handler does not insert an option terminator before... Moderate Unreviewed
CVE-2026-78635 was published Sep 8, 2026
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution High
CVE-2026-76220 was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use
Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution High
GHSA-wv46-xpj8-pw53 was published for gitpython (pip) Aug 19, 2026 • withdrawn
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite High
CVE-2026-76219 was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use and bhaswanthc bhaswanthc bhaswanthc
Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite High
GHSA-7jx3-jqcp-hhgc was published for gitpython (pip) Aug 19, 2026 • withdrawn
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks High
CVE-2026-76218 was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use and BarakSrour BarakSrour BarakSrour
Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks High
GHSA-298h-jpq4-m665 was published for GitPython (pip) Aug 19, 2026 • withdrawn
GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251) Moderate
CVE-2026-78679 was published for GitPython (pip) Sep 8, 2026
manus-use Credited to manus-use
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame() Moderate
CVE-2026-78678 was published for GitPython (pip) Sep 8, 2026
manus-use Credited to manus-use
Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame() High
GHSA-89ff-m8wv-p99r was published for gitpython (pip) Aug 25, 2026 • withdrawn
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE Critical
CVE-2026-78676 was published for GitPython (pip) Sep 8, 2026
Pig-Tail Credited to Pig-Tail
Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE Critical
GHSA-9557-234j-7rv9 was published for GitPython (pip) Aug 25, 2026 • withdrawn
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database