Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

16 advisories

Loading
Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig) Moderate
GHSA-6jq6-x4cx-qvcm was published for grumpydictator/firefly-iii (Composer) Jun 12, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope Moderate
CVE-2026-54094 was published for github.com/filebrowser/filebrowser (Go) Jun 12, 2026
DavidCarliez Credited to DavidCarliez, hacdias, m2hcz, and iaohkut-from-NightWolf-Team hacdias hacdias
m2hcz m2hcz iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team
motionEye's missing authentication on ActionHandler allows unauthenticated camera action execution Moderate
CVE-2026-55863 was published for motioneye (pip) Jun 23, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team, MichaIng, zagrim, Marijn0, and C4spr0x1A MichaIng MichaIng
zagrim zagrim Marijn0 Marijn0 C4spr0x1A C4spr0x1A
SvelteKit: Prototype pollution in file input deletion path in remote-function forms Moderate
GHSA-866w-xmhq-wj7x was published for @sveltejs/kit (npm) Jul 24, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team and dummdidumm dummdidumm dummdidumm
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields Moderate
CVE-2026-59728 was published for @astrojs/rss (npm) Jul 20, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Wagtail: Pages translations can be created without page permissions when using simple_translation Moderate
CVE-2026-54262 was published for wagtail (pip) Aug 20, 2026
devansh3008 Credited to devansh3008, zerolab, gasman, and iaohkut-from-NightWolf-Team zerolab zerolab
gasman gasman iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team
Laravel Backpack CRUD: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation Moderate
CVE-2026-57570 was published for backpack/crud (Composer) Aug 20, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team, pxpm, and tabacitu pxpm pxpm
tabacitu tabacitu
Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username Moderate
CVE-2026-63466 was published for unleash-server (npm) Aug 21, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data Moderate
CVE-2026-65959 was published for vitess.io/vitess (Go) Aug 18, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS Moderate
GHSA-rgwj-5xj2-c3m3 was published for mysql2 (npm) Aug 31, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
morgan vulnerable to Log Forging via unescaped Unicode line separators Moderate
CVE-2026-15603 was published for morgan (npm) Sep 8, 2026
mfazrinizar Credited to mfazrinizar, UlisesGascon, jonchurch, bjohansebas, and iaohkut-from-NightWolf-Team UlisesGascon UlisesGascon
jonchurch jonchurch bjohansebas bjohansebas iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate Moderate
CVE-2026-75834 was published for getgrav/grav (Composer) Sep 17, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS Moderate
GHSA-3hv7-mjh2-fv65 was published for tornado (pip) Sep 30, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team and manus-pi manus-pi manus-pi
LangChain: MongoDBChatMessageHistory query injection can allow cross-session access Moderate
CVE-2026-106119 was published for @langchain/mongodb (npm) Oct 8, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
AdonisJS: Unencoded route parameters can produce open redirects Moderate
CVE-2026-107718 was published for @adonisjs/http-server (npm) Oct 8, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
launch-editor: escapeCmdArgs() omits % escaping on Windows Moderate
CVE-2026-112943 was published for launch-editor (npm) Oct 20, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team, the-vibe-dev, Rikuxx0, and bluwy the-vibe-dev the-vibe-dev
Rikuxx0 Rikuxx0 bluwy bluwy
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database