Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

453 advisories

Loading
A flaw was found in the Visual Studio Code Ansible Lightspeed extension's... High Unreviewed
CVE-2026-44189 was published Jul 22, 2026
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()` High
CVE-2026-67323 was published for GitPython (pip) Jul 21, 2026
miauzxw Credited to miauzxw
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's... High Unreviewed
CVE-2026-16493 was published Jul 21, 2026
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line... High Unreviewed
CVE-2026-64624 was published Jul 21, 2026
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials Critical
CVE-2026-61459 was published for mcp-server-kubernetes (npm) Jul 10, 2026
PercevalFox Credited to PercevalFox, devjoinedthechat, and wlassalle724 devjoinedthechat devjoinedthechat
wlassalle724 wlassalle724
File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) Critical
CVE-2026-54088 was published for github.com/filebrowser/filebrowser/v2 (Go) Jul 10, 2026
Saku0512 Credited to Saku0512 and hacdias hacdias hacdias
Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH... High Unreviewed
CVE-2026-47829 was published Jul 9, 2026
Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer Critical
CVE-2026-40047 was published for org.apache.camel:camel-docling (Maven) Jul 6, 2026
oscerd Credited to oscerd
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability... High Unreviewed
CVE-2026-14459 was published Jul 3, 2026
Linuxfabrik Monitoring Plugins: Sudoers may be able to obtain privilege escalation via /usr/bin/apt-get arguments High
CVE-2026-52817 was published for linuxfabrik-lib (pip) Jul 2, 2026
OoYo0uto Credited to OoYo0uto
Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true) High
GHSA-vv65-f55v-xm6g was published for @grackle-ai/powerline (npm) Jul 2, 2026
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection High
CVE-2026-49987 was published for repomix (npm) Jul 1, 2026
kakashi-kx Credited to kakashi-kx
A flaw was found in the vscode-java extension, which provides Java language support for Visual... High Unreviewed
CVE-2026-12856 was published Jun 29, 2026
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit Moderate
CVE-2026-50014 was published for pnpm (npm) Jun 26, 2026
tempcollab Credited to tempcollab
@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths Moderate
GHSA-5vwr-qchf-q4pf was published for @cyclonedx/cdxgen (npm) Jun 26, 2026
aleff-github Credited to aleff-github
Argument Injection in TortoiseGitBlame via Malicious Git History Filenames Leads to Arbitrary... Moderate Unreviewed
CVE-2026-11968 was published Jun 24, 2026
skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery High
GHSA-74p7-6h78-gw8p was published for skillctl (Rust) Jun 22, 2026
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages() High
CVE-2026-12530 was published for bedrock-agentcore (pip) Jun 19, 2026
MrCloudSec Credited to MrCloudSec
Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args Critical
GHSA-r253-r9jw-qg44 was published for crawl4ai (pip) Jun 18, 2026
hoanggxyuuki Credited to hoanggxyuuki
Docker MCP Gateway: Argument injection via OCI image label YAML High
CVE-2026-55887 was published for github.com/docker/mcp-gateway (Go) Jun 18, 2026
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM,... Critical Unreviewed
CVE-2026-47365 was published Jun 12, 2026
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability... High Unreviewed
CVE-2026-53694 was published Jun 10, 2026
MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration Moderate
CVE-2026-47250 was published for mcp-server-kubernetes (npm) Jun 5, 2026
yotampe-pluto Credited to yotampe-pluto
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution High
CVE-2026-11332 was published for ansible-core (pip) Jun 5, 2026
Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release... High Unreviewed
CVE-2026-41013 was published Jun 1, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database