Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,191
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

20 advisories

Loading
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS High
CVE-2026-104827 was published for react/http (Composer) Oct 15, 2026
EQSTLab Credited to EQSTLab, WyriHaximus, and 232-323 WyriHaximus WyriHaximus
232-323 232-323
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions Critical
CVE-2026-10032 was published for @a2ui/web_core (npm) Oct 2, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path High
CVE-2026-77246 was published for mcp-atlassian (pip) Sep 22, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission High
CVE-2026-59965 was published for @jhb.software/payload-alt-text-plugin (npm) Sep 10, 2026
EQSTLab Credited to EQSTLab, 232-323, and Kxrma47 232-323 232-323
Kxrma47 Kxrma47
@arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key High
CVE-2026-55604 was published for @arikusi/deepseek-mcp-server (npm) Aug 25, 2026
232-323 Credited to 232-323 and arikusi arikusi arikusi
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion High
GHSA-8cp3-qxj6-px34 was published for utcp-http (pip) Aug 25, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints Moderate
CVE-2026-55156 was published for @ooples/token-optimizer-mcp (npm) Aug 14, 2026
232-323 Credited to 232-323
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation High
GHSA-p7w7-4929-vpj5 was published for @dynatrace-oss/dynatrace-mcp-server (npm) Jul 31, 2026
EQSTLab Credited to EQSTLab, 232-323, and yotampe-pluto 232-323 232-323
yotampe-pluto yotampe-pluto
kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default Critical
GHSA-r277-6w6q-xmqw was published for github.com/getkin/kin-openapi (Go) Jul 24, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store High
CVE-2026-54447 was published for garminconnect (pip) Jul 15, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token High
CVE-2026-50143 was published for @apify/actors-mcp-server (npm) Jul 1, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing High
GHSA-h5x8-xp6m-x6q4 was published for @jhb.software/payload-cloudinary-plugin (npm) Jun 19, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution High
GHSA-wg5p-8h9p-3mr7 was published for agent-coderag (pip) Jun 19, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token Critical
CVE-2026-48039 was published for meta-ads-mcp (pip) Jun 11, 2026
232-323 Credited to 232-323
OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri High
CVE-2026-48054 was published for @openzeppelin/wizard (npm) Jun 11, 2026
232-323 Credited to 232-323 and knm6777 knm6777 knm6777
Anyquery has Path Traversal through `clear_plugin_cache`, Allowing Arbitrary Directory Deletion High
CVE-2026-47253 was published for github.com/julien040/anyquery (Go) Jun 10, 2026
232-323 Credited to 232-323 and yym8538 yym8538 yym8538
Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin Critical
CVE-2026-47252 was published for github.com/julien040/anyquery/plugins/brave (Go) Jun 8, 2026
232-323 Credited to 232-323
Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret High
CVE-2026-46701 was published for network-ai (npm) May 21, 2026
232-323 Credited to 232-323 and min8282 min8282 min8282
@profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module Critical
GHSA-v6wj-c83f-v46x was published for @profullstack/mcp-server (npm) May 9, 2026
232-323 Credited to 232-323
Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls High
CVE-2026-42856 was published for network-ai (npm) May 5, 2026
232-323 Credited to 232-323 and 2REBCat 2REBCat 2REBCat
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database