Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

6 advisories

Loading
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) Critical
CVE-2026-73649 was published for velocityjs (npm) Jul 24, 2026
cruzryan Credited to cruzryan and cuauht cuauht cuauht
ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass Moderate
CVE-2026-101910 was published for ip-address (npm) Sep 28, 2026
cruzryan Credited to cruzryan
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects Moderate
CVE-2026-104183 was published for stream-json (npm) Oct 5, 2026
cruzryan Credited to cruzryan
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) High
CVE-2026-102827 was published for simple-git (npm) Oct 5, 2026
anir0y Credited to anir0y, bilguunbicktivism, cruzryan, the-vibe-dev, D7EAD, dellalibera, gdegrange, CFionaBF, b1ue0ceanRun, Leeziao, internetteletubbie, and arundr0id bilguunbicktivism bilguunbicktivism
cruzryan cruzryan the-vibe-dev the-vibe-dev D7EAD D7EAD dellalibera dellalibera gdegrange gdegrange CFionaBF CFionaBF b1ue0ceanRun b1ue0ceanRun Leeziao Leeziao internetteletubbie internetteletubbie arundr0id arundr0id
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies Moderate
CVE-2026-118661 was published for happy-dom (npm) Oct 28, 2026
cruzryan Credited to cruzryan
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check High
CVE-2026-116580 was published for seroval (npm) Oct 28, 2026
cruzryan Credited to cruzryan
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database