Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,583
Rust
21

692 advisories

Loading
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie Moderate
CVE-2026-118777 was published for node-forge (npm) Oct 30, 2026
arunmozhivarman-dtx Credited to arunmozhivarman-dtx and Dremig Dremig Dremig
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution... Moderate Unreviewed
CVE-2026-119569 was published Oct 30, 2026
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that... High Unreviewed
CVE-2026-118678 was published Oct 28, 2026
n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each... High Unreviewed
CVE-2026-118649 was published Oct 28, 2026
systeminformation has prototype pollution in `networkStats()` via the interface name Moderate
CVE-2026-116674 was published for systeminformation (npm) Oct 28, 2026
Highcharts: dotted series.keys paths write to Object.prototype High
CVE-2026-118250 was published for highcharts (npm) Oct 28, 2026
Highcharts: series column construction writes to Object.prototype High
CVE-2026-118249 was published for highcharts (npm) Oct 28, 2026
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. Moderate
CVE-2026-118247 was published for @highcharts/dashboards (npm) Oct 28, 2026
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` Moderate
CVE-2026-118243 was published for @highcharts/dashboards (npm) Oct 28, 2026
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype High
CVE-2026-114142 was published for tome (npm) Oct 22, 2026
b1ue0ceanRun Credited to b1ue0ceanRun
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments High
CVE-2026-114604 was published for @graphql-tools/utils (npm) Oct 22, 2026
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users Moderate
CVE-2026-113659 was published for apostrophe (npm) Oct 20, 2026
Xx-LoGiCaL-xX Credited to Xx-LoGiCaL-xX
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service High
CVE-2026-113666 was published for @apostrophecms/db-connect (npm) Oct 20, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows... High Unreviewed
CVE-2026-112309 was published Oct 19, 2026
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields()... Moderate Unreviewed
CVE-2026-111172 was published Oct 15, 2026
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys... Moderate Unreviewed
CVE-2026-106160 was published Oct 15, 2026
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the... High Unreviewed
CVE-2026-110842 was published Oct 15, 2026
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution... Moderate Unreviewed
CVE-2026-110848 was published Oct 15, 2026
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any... High Unreviewed
CVE-2026-110111 was published Oct 13, 2026
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to... High Unreviewed
CVE-2021-48012 was published Oct 12, 2026
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to... High Unreviewed
CVE-2026-107701 was published Oct 8, 2026
msgpack5: Partial options disable prototype protection Moderate
CVE-2026-107301 was published for msgpack5 (npm) Oct 8, 2026
Payload: Remote Code Execution through first-register High
CVE-2026-105858 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload Form Builder has an RCE issue Critical
CVE-2026-105857 was published for @payloadcms/plugin-form-builder (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload: Prototype pollution in Payload Import Export plugin Critical
CVE-2026-105844 was published for @payloadcms/plugin-import-export (npm) Oct 6, 2026
iamnoooob Credited to iamnoooob
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database