Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

12 advisories

Loading
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees Moderate
CVE-2026-69248 was published for cryptography (pip) Aug 3, 2026
randombit Credited to randombit, woodruffw, tal-sealsecurity, frenzymadness, and nikpivkin woodruffw woodruffw
tal-sealsecurity tal-sealsecurity frenzymadness frenzymadness nikpivkin nikpivkin
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building High
CVE-2026-69249 was published for cryptography (pip) Aug 3, 2026
sjudson Credited to sjudson, woodruffw, dguerri, frenzymadness, and nikpivkin woodruffw woodruffw
dguerri dguerri frenzymadness frenzymadness nikpivkin nikpivkin
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573) High
GHSA-94p4-4cq8-9g67 was published for GitPython (pip) Jul 24, 2026
alimony Credited to alimony and nikpivkin nikpivkin nikpivkin
Flowise: Cypher Injection in GraphCypherQAChain High
CVE-2026-41274 was published for flowise (npm) Apr 16, 2026
tenbbughunters Credited to tenbbughunters and nikpivkin nikpivkin nikpivkin
Parse Server's GraphQL WebSocket endpoint bypasses security middleware Moderate
CVE-2026-32594 was published for parse-server (npm) Mar 13, 2026
fancymalware Credited to fancymalware, mtrezza, and nikpivkin mtrezza mtrezza
nikpivkin nikpivkin
Craft CMS has a potential information disclosure vulnerability in preview tokens Low
CVE-2026-29113 was published for craftcms/cms (Composer) Mar 10, 2026
singetu0096 Credited to singetu0096 and nikpivkin nikpivkin nikpivkin
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation High
CVE-2026-26318 was published for systeminformation (npm) Feb 18, 2026
Sanu1999 Credited to Sanu1999 and nikpivkin nikpivkin nikpivkin
socket.io has an unhandled 'error' event Moderate
CVE-2024-38355 was published for socket.io (npm) Jun 19, 2024
Y0ursTruly Credited to Y0ursTruly and nikpivkin nikpivkin nikpivkin
json-web-token library is vulnerable to a JWT algorithm confusion attack High
CVE-2023-48238 was published for json-web-token (npm) Nov 17, 2023
PinkDraconian Credited to PinkDraconian and nikpivkin nikpivkin nikpivkin
snipe-IT vulnerable to host header injection High
CVE-2022-23064 was published for snipe/snipe-it (Composer) May 3, 2022
zyl71 Credited to zyl71 and nikpivkin nikpivkin nikpivkin
Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy Moderate
CVE-2022-0577 was published for scrapy (pip) Mar 1, 2022
ranjit-git Credited to ranjit-git and nikpivkin nikpivkin nikpivkin
Potential buffer overflow in psd-tools Critical
CVE-2020-10571 was published for psd-tools (pip) Mar 16, 2020
nikpivkin Credited to nikpivkin
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database