Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

32 advisories

Loading
Talos Linux: Support bundle does not redact registry credentials Low
CVE-2026-77564 was published for github.com/siderolabs/talos (Go) Oct 15, 2026
Thanzex Credited to Thanzex and zuhairhalawa zuhairhalawa zuhairhalawa
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check Moderate
GHSA-fmmf-xq98-g327 was published for code.vikunja.io/api (Go) Oct 9, 2026
zuhairhalawa Credited to zuhairhalawa
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants Moderate
GHSA-fprf-r6rv-xg99 was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei and zuhairhalawa zuhairhalawa zuhairhalawa
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes Moderate
GHSA-4hv6-xc92-j86g was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei and zuhairhalawa zuhairhalawa zuhairhalawa
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure High
CVE-2026-76216 was published for code.vikunja.io/api (Go) Oct 9, 2026
manus-use Credited to manus-use and zuhairhalawa zuhairhalawa zuhairhalawa
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host Moderate
GHSA-p3pr-8f3m-4qp8 was published for pyload-ng (pip) Oct 9, 2026
manus-pi Credited to manus-pi, manus-use, eprogressing, and zuhairhalawa manus-use manus-use
eprogressing eprogressing zuhairhalawa zuhairhalawa
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry Moderate
CVE-2026-46438 was published for wger (pip) Oct 7, 2026
KadirArslan Credited to KadirArslan and zuhairhalawa zuhairhalawa zuhairhalawa
wger: Trainer Privilege Escalation - Improper Privilege Management High
CVE-2026-46434 was published for wger (pip) Oct 7, 2026
KadirArslan Credited to KadirArslan and zuhairhalawa zuhairhalawa zuhairhalawa
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views) High
CVE-2026-43976 was published for wger (pip) Oct 7, 2026
whatisproblem Credited to whatisproblem and zuhairhalawa zuhairhalawa zuhairhalawa
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection Low
CVE-2026-72701 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi and zuhairhalawa zuhairhalawa zuhairhalawa
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure High
CVE-2026-69088 was published for getgrav/grav (Composer) Sep 17, 2026
adamyordan Credited to adamyordan and zuhairhalawa zuhairhalawa zuhairhalawa
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS High
CVE-2026-71553 was published for apostrophe (npm) Sep 2, 2026
breakingsystems Credited to breakingsystems and zuhairhalawa zuhairhalawa zuhairhalawa
IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries High
CVE-2026-54550 was published for org.codehaus.izpack:izpack-installer (Maven) Aug 26, 2026
sectroyer Credited to sectroyer and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM Insecure SSO Cookie Initialization High
CVE-2026-53660 was published for org.openidentityplatform.openam:openam-core (Maven) Aug 14, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) High
CVE-2026-76913 was published for notrinos/notrinos-erp (Composer) Jul 10, 2026
KasperBuilds Credited to KasperBuilds and zuhairhalawa zuhairhalawa zuhairhalawa
Goploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise High
CVE-2026-53553 was published for github.com/zhenorzz/goploy (Go) Jul 7, 2026
What-canIsay Credited to What-canIsay and zuhairhalawa zuhairhalawa zuhairhalawa
Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers Critical
CVE-2026-53552 was published for github.com/zhenorzz/goploy (Go) Jul 7, 2026
tonghuaroot Credited to tonghuaroot and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM OAuth Client Impersonation via JWKS Resolver Cache High
CVE-2026-47426 was published for org.openidentityplatform.openam:openam-oauth2 (Maven) Jun 29, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module High
CVE-2026-46623 was published for org.openidentityplatform.openam:openam-auth-oauth2 (Maven) Jun 26, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM Authentication Bypass via MSISDN LDAP Injection High
CVE-2026-46619 was published for org.openidentityplatform.openam:openam-auth-msisdn (Maven) Jun 26, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM: Unauthenticated Authentication Bypass via RADIUS Spoofing High
CVE-2026-46560 was published for org.openidentityplatform.openam:openam-radius (Maven) Jun 25, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM Arbitrary OAuth Token Minting via Push Registration High
CVE-2026-46498 was published for org.openidentityplatform.openam:openam-oauth2 (Maven) Jun 25, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM has Unsafe Java Deserialization via SNS High
CVE-2026-45794 was published for org.openidentityplatform.openam:openam-push-notification (Maven) Jun 25, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM: Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage Critical
CVE-2026-45051 was published for org.openidentityplatform.openam:openam-auth-webauthn (Maven) Jun 24, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
OpenAM Unauthenticated Session Hijacking via Information Exposure in CDCServlet High
CVE-2026-45049 was published for org.openidentityplatform.openam:openam-federation (Maven) Jun 23, 2026
wodzen Credited to wodzen and zuhairhalawa zuhairhalawa zuhairhalawa
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database