Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,191
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

692 advisories

Loading
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt Moderate
CVE-2026-2950 was published for lodash (npm) Apr 1, 2026
Haruna38 Credited to Haruna38, shpik-kr, maru1009, ott3r07, zolbooo, backuardo, falsyvalues, jonchurch, jdalton, UlisesGascon, Kteamk, and eoftedal shpik-kr shpik-kr
maru1009 maru1009 ott3r07 ott3r07 zolbooo zolbooo backuardo backuardo falsyvalues falsyvalues jonchurch jonchurch jdalton jdalton UlisesGascon UlisesGascon Kteamk Kteamk eoftedal eoftedal
A vulnerability found in postgresql. On this security issue an attack requires permission to... High Unreviewed
CVE-2022-2625 was published Aug 19, 2022
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie Moderate
CVE-2026-118777 was published for node-forge (npm) Oct 30, 2026
arunmozhivarman-dtx Credited to arunmozhivarman-dtx and Dremig Dremig Dremig
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution... Moderate Unreviewed
CVE-2026-119569 was published Oct 30, 2026
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that... High Unreviewed
CVE-2026-118678 was published Oct 28, 2026
n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each... High Unreviewed
CVE-2026-118649 was published Oct 28, 2026
systeminformation has prototype pollution in `networkStats()` via the interface name Moderate
CVE-2026-116674 was published for systeminformation (npm) Oct 28, 2026
Highcharts: dotted series.keys paths write to Object.prototype High
CVE-2026-118250 was published for highcharts (npm) Oct 28, 2026
Highcharts: series column construction writes to Object.prototype High
CVE-2026-118249 was published for highcharts (npm) Oct 28, 2026
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. Moderate
CVE-2026-118247 was published for @highcharts/dashboards (npm) Oct 28, 2026
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` Moderate
CVE-2026-118243 was published for @highcharts/dashboards (npm) Oct 28, 2026
ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS High
CVE-2026-71553 was published for apostrophe (npm) Sep 2, 2026
breakingsystems Credited to breakingsystems and zuhairhalawa zuhairhalawa zuhairhalawa
deepmerge mergeObject() allows prototype poisoning of returned objects Low
CVE-2026-93753 was published for deepmerge (npm) Sep 18, 2026
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype High
CVE-2026-114142 was published for tome (npm) Oct 22, 2026
b1ue0ceanRun Credited to b1ue0ceanRun
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments High
CVE-2026-114604 was published for @graphql-tools/utils (npm) Oct 22, 2026
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users Moderate
CVE-2026-113659 was published for apostrophe (npm) Oct 20, 2026
Xx-LoGiCaL-xX Credited to Xx-LoGiCaL-xX
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service High
CVE-2026-113666 was published for @apostrophecms/db-connect (npm) Oct 20, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows... High Unreviewed
CVE-2026-112309 was published Oct 19, 2026
@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields()... Moderate Unreviewed
CVE-2026-111172 was published Oct 15, 2026
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys... Moderate Unreviewed
CVE-2026-106160 was published Oct 15, 2026
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the... High Unreviewed
CVE-2026-110842 was published Oct 15, 2026
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution... Moderate Unreviewed
CVE-2026-110848 was published Oct 15, 2026
Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any... High Unreviewed
CVE-2026-110111 was published Oct 13, 2026
fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to... High Unreviewed
CVE-2021-48012 was published Oct 12, 2026
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to... High Unreviewed
CVE-2026-107701 was published Oct 8, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database