Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

60 advisories

Loading
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server... Critical Unreviewed
CVE-2026-115812 was published Oct 23, 2026
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway... Critical Unreviewed
CVE-2026-76519 was published Oct 14, 2026
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation... Critical Unreviewed
CVE-2026-103663 was published Oct 8, 2026
A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco... Critical Unreviewed
CVE-2026-76454 was published Oct 7, 2026
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500... Critical Unreviewed
CVE-2026-8066 was published Sep 29, 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure... Critical Unreviewed
CVE-2026-76440 was published Sep 14, 2026
Apache FreeMarker template loading mechanism vulnerable to path traversal Critical
CVE-2026-84939 was published for org.freemarker:freemarker (Maven) Sep 10, 2026
oscerd Credited to oscerd and hypoflex hypoflex hypoflex
A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE... Critical Unreviewed
CVE-2026-67367 was published Sep 8, 2026
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir Critical
CVE-2026-66906 was published for org.apache.camel:camel-azure-storage-blob (Maven) Aug 24, 2026
oscerd Credited to oscerd
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges... Critical Unreviewed
CVE-2026-63509 was published Aug 21, 2026
The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to... Critical Unreviewed
CVE-2026-16230 was published Aug 11, 2026
In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project... Critical Unreviewed
CVE-2026-59792 was published Jul 10, 2026
Gogs has Path Traversal in organization name that results in RCE through Git hooks Critical
CVE-2026-52813 was published for gogs.io/gogs (Go) Jun 23, 2026
Aikido-Security Credited to Aikido-Security, JorianWoltjer, reindaelman, and grumpinout1 JorianWoltjer JorianWoltjer
reindaelman reindaelman grumpinout1 grumpinout1
Path traversal vulnerability in Remote Spark (https://www.Remotespark.Com/) SparkView allows... Critical Unreviewed
CVE-2026-8326 was published May 29, 2026
XWiki Platform has path traversal via resources parameter in ssx and jsx endpoints when using leading slash Critical
CVE-2026-23734 was published for org.xwiki.commons:xwiki-commons-classloader-api (Maven) May 26, 2026
majkelstick Credited to majkelstick
Concrete CMS Vulnerable to Relative Path Traversal Critical
CVE-2026-8134 was published for concrete5/concrete5 (Composer) May 21, 2026
Dify version 1.14.1 and prior contain a path traversal vulnerability that allows authenticated... Critical Unreviewed
CVE-2026-41948 was published May 18, 2026
A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a... Critical Unreviewed
CVE-2026-41551 was published May 12, 2026
django-s3file is vulnerable to relative path traversal Critical
CVE-2026-42196 was published for django-s3file (pip) May 5, 2026
stsewd Credited to stsewd and amureki amureki amureki
Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the... Critical Unreviewed
CVE-2026-4415 was published Mar 30, 2026
Ory Oathkeeper has a path traversal authorization bypass Critical
CVE-2026-33494 was published for github.com/ory/oathkeeper (Go) Mar 20, 2026
Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern Critical
CVE-2025-62878 was published for github.com/rancher/local-path-provisioner (Go) Feb 4, 2026
In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to... Critical Unreviewed
CVE-2024-47856 was published Nov 25, 2025
LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction Critical
GHSA-rj4j-2jph-gg43 was published for github.com/lf-edge/ekuiper/v2 (Go) Nov 24, 2025
odaysec Credited to odaysec and kochrac kochrac kochrac
A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0... Critical Unreviewed
CVE-2025-64446 was published Nov 14, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database