Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

55 advisories

Loading
Apache Spark History Server allows stored cross-site scripting through unescaped application names Moderate
CVE-2026-32773 was published for org.apache.spark:spark-core_2.12 (Maven) Sep 2, 2026
oscerd Credited to oscerd
Apache Airflow missing team context permits cross-team Dag actions and XCom reads Moderate
CVE-2026-68971 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow environment-variable secrets backend permits cross-team credential use Moderate
CVE-2026-68076 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow Task SDK fails to mask list-shaped JSON Variables Moderate
CVE-2026-68970 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow bulk endpoints log Variable and Connection secrets in cleartext Moderate
CVE-2026-68969 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterables Moderate
CVE-2026-54183 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow exposes dict-valued var.json secrets in Rendered Templates Moderate
CVE-2026-59244 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow Config API exposes team-scoped sensitive configuration values Moderate
CVE-2026-65017 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow XCom API permits unsafe deserialization through JSON string literals Moderate
CVE-2026-59242 was published for apache-airflow (pip) Aug 12, 2026
oscerd Credited to oscerd
Apache Airflow Yandex Lockbox backend allows cross-team secret disclosure Moderate
CVE-2026-68871 was published for apache-airflow-providers-yandex (pip) Aug 10, 2026
oscerd Credited to oscerd
Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit Moderate
CVE-2026-66053 was published for thrift (pip) Jul 27, 2026
carlosfunk Credited to carlosfunk and oscerd oscerd oscerd
Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy Moderate
CVE-2026-63621 was published for org.apache.camel:camel-knative (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir Moderate
CVE-2026-60093 was published for org.apache.camel:camel-azure-storage-datalake (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled Moderate
CVE-2026-59230 was published for org.apache.camel:camel-mail (Maven) Aug 24, 2026
oscerd Credited to oscerd
Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers Moderate
CVE-2026-49086 was published for org.apache.camel:camel-dapr (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter Moderate
CVE-2026-49098 was published for org.apache.camel:camel-kafka (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter Moderate
CVE-2026-49097 was published for org.apache.camel:camel-irc (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body Moderate
CVE-2026-49365 was published for org.apache.camel:camel-netty-http (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter Moderate
CVE-2026-49099 was published for org.apache.camel:camel-salesforce (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body Moderate
CVE-2026-56139 was published for org.apache.camel:camel-undertow (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter Moderate
CVE-2026-48206 was published for org.apache.camel:camel-jira (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation Moderate
CVE-2026-46453 was published for org.apache.camel:camel-elasticsearch-rest-client (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache SkyWalking has a stored XSS vulnerability Moderate
CVE-2025-54057 was published for org.apache.skywalking:apm-webapp (Maven) Nov 27, 2025
oscerd Credited to oscerd
quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class Moderate
CVE-2026-40180 was published for io.quarkiverse.openapi.generator:quarkus-openapi-generator (Maven) Apr 8, 2026
oscerd Credited to oscerd and ricardozanini ricardozanini ricardozanini
Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users Moderate
CVE-2024-26280 was published for apache-airflow (pip) Mar 1, 2024
oscerd Credited to oscerd and sunSUNQ sunSUNQ sunSUNQ
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database