Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

23 advisories

Loading
1Panel command injection vulnerability in Firewall ip functionality High
CVE-2023-37477 was published for github.com/1Panel-dev/1Panel (Go) Jul 18, 2023
Malayke Credited to Malayke and amascia-gg amascia-gg amascia-gg
grav Server-side Template Injection (SSTI) mitigation bypass High
CVE-2023-37897 was published for getgrav/grav (Composer) Jul 19, 2023
s4ex Credited to s4ex and Malayke Malayke Malayke
1Panel vulnerable to command injection when entering the container terminal Moderate
CVE-2023-36458 was published for github.com/1Panel-dev/1Panel (Go) Jul 5, 2023
Malayke Credited to Malayke
Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input High
CVE-2023-37279 was published for github.com/contribsys/faktory (Go) Sep 20, 2023
Malayke Credited to Malayke
KubeSphere IDOR vulnerability Moderate
CVE-2024-46528 was published for github.com/kubesphere/kubesphere (Go) Oct 14, 2024
Malayke Credited to Malayke
GoCast OS Command Injection vulnerability Critical
CVE-2024-28892 was published for github.com/mayuresh82/gocast (Go) Dec 20, 2024
Malayke Credited to Malayke
Path traversal vulnerability in functional web frameworks High
CVE-2024-38816 was published for org.springframework:spring-webflux (Maven) Sep 13, 2024
Malayke Credited to Malayke, AlexeyTsvetkov, andreeaButerchi, and aantonel-sysdig AlexeyTsvetkov AlexeyTsvetkov
andreeaButerchi andreeaButerchi aantonel-sysdig aantonel-sysdig
Apache MINA Deserialization RCE Vulnerability Critical
CVE-2024-52046 was published for org.apache.mina:mina-core (Maven) Dec 25, 2024
Malayke Credited to Malayke
Ed25519 Signature Malleability in ed25519-java Due to Missing Scalar Range Check Moderate
CVE-2020-36843 was published for net.i2p.crypto:eddsa (Maven) Mar 13, 2025
Malayke Credited to Malayke
Grafana Command Injection And Local File Inclusion Via Sql Expressions Critical
CVE-2024-9264 was published for github.com/grafana/grafana (Go) Oct 18, 2024
Malayke Credited to Malayke
gurk (aka gurk-rs) mishandles ANSI escape sequences Moderate
CVE-2025-30089 was published for gurk (Rust) Mar 17, 2025
Malayke Credited to Malayke
Prototype Pollution Vulnerability in parse-git-config High
CVE-2025-25975 was published for parse-git-config (npm) Mar 12, 2025
Malayke Credited to Malayke
OSV-SCALIBR's Container Image Unpacking Vulnerable to Arbitrary File Write via Path Traversal Moderate
CVE-2025-5981 was published for github.com/google/osv-scalibr (Go) Jun 18, 2025
Malayke Credited to Malayke
n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook Critical
CVE-2025-65964 was published for n8n (npm) Dec 8, 2025
Malayke Credited to Malayke
@react-native-community/cli has arbitrary OS command injection Critical
CVE-2025-11953 was published for @react-native-community/cli (npm) Nov 3, 2025
Malayke Credited to Malayke, cylewaitforit, liamjones, and conorfitch cylewaitforit cylewaitforit
liamjones liamjones conorfitch conorfitch
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization Critical
CVE-2025-49113 was published for roundcube/roundcubemail (Composer) Jun 2, 2025
Malayke Credited to Malayke
llama_index vulnerable to SQL Injection Critical
CVE-2025-1793 was published for llama-index (pip) Jun 5, 2025
Malayke Credited to Malayke
Duplicate Advisory: AI Agents Project Viewer Privilege Escalation via run_node_tool High
GHSA-w46p-w7w2-fr9g was published for n8n (npm) Jul 22, 2026 • withdrawn
Malayke Credited to Malayke
Duplicate Advisory: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution High
GHSA-725q-c4vp-q4cg was published for n8n (npm) Jul 22, 2026 • withdrawn
Malayke Credited to Malayke
Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview High
GHSA-vhcw-f978-xjjg was published for n8n (npm) Jul 22, 2026 • withdrawn
Malayke Credited to Malayke
Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl` High
GHSA-h5xr-fqvj-253p was published for n8n (npm) Jul 22, 2026 • withdrawn
Malayke Credited to Malayke
Duplicate Advisory: Google Service Account Private Key Exposed in JWT Header Moderate
GHSA-mhvh-gwhr-76pw was published for n8n (npm) Jul 22, 2026 • withdrawn
Malayke Credited to Malayke
Duplicate Advisory: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware High
GHSA-rhg6-2vjh-j5qc was published for github.com/traefik/traefik/v2 (Go) Jul 22, 2026 • withdrawn
Malayke Credited to Malayke
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database