Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

177 advisories

Loading
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration Moderate
CVE-2026-118653 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
bugbunny-research Credited to bugbunny-research
Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability High
CVE-2026-70179 was published for Microsoft.AspNetCore.Authentication.Negotiate (NuGet) Oct 13, 2026
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover High
CVE-2026-62367 was published for code.vikunja.io/api (Go) Oct 9, 2026
maskop9 Credited to maskop9 and evilgensec evilgensec evilgensec
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header Moderate
GHSA-9q47-3cm2-2rp8 was published for pyload-ng (pip) Oct 9, 2026
nirtem Credited to nirtem
Payload authentication token field handling issue Critical
CVE-2026-105863 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control High
CVE-2026-104891 was published for @insumermodel/mppx-condition-gate (npm) Oct 7, 2026
chenshj73 Credited to chenshj73
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write High
CVE-2026-105741 was published for langflow (pip) Oct 7, 2026
erichare Credited to erichare and andifilhohub andifilhohub andifilhohub
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing High
CVE-2026-61428 was published for praisonai (pip) Oct 7, 2026
dinhvaren Credited to dinhvaren
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet Critical
CVE-2026-90711 was published for proxy-addr (npm) Oct 5, 2026
kagebunsher Credited to kagebunsher, UlisesGascon, and kustundag UlisesGascon UlisesGascon
kustundag kustundag
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse High
CVE-2026-56675 was published for 9router (npm) Sep 23, 2026
dinhvaren Credited to dinhvaren
Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header Moderate
CVE-2026-62987 was published for github.com/fabiolb/fabio (Go) Sep 22, 2026
thientd Credited to thientd
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace Critical
CVE-2026-61682 was published for github.com/kcp-dev/kcp (Go) Sep 18, 2026
5ud0er Credited to 5ud0er
libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses High
CVE-2026-86039 was published for @libp2p/peer-store (npm) Sep 17, 2026
Alleysira Credited to Alleysira
Traefik: ForwardAuth identity spoofing via dot-form header alias Moderate
CVE-2026-88011 was published for github.com/traefik/traefik/v2 (Go) Sep 10, 2026
velgusgus599 Credited to velgusgus599
webhookd: Unrestricted HTTP Header to Shell Variable Injection Moderate
CVE-2026-59157 was published for github.com/ncarlier/webhookd (Go) Sep 9, 2026
GimmyDatBeeR Credited to GimmyDatBeeR
SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy High
CVE-2026-72809 was published for github.com/siyuan-note/siyuan/kernel (Go) Sep 3, 2026
Shirshakhtml Credited to Shirshakhtml
OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass) Moderate
CVE-2026-73840 was published for github.com/openchoreo/openchoreo (Go) Sep 2, 2026
ihopenre-eng Credited to ihopenre-eng
Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends Critical
CVE-2026-71485 was published for github.com/centrifugal/centrifugo (Go) Sep 2, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF High
CVE-2026-55641 was published for 9router (npm) Aug 28, 2026
EchoSkorJjj Credited to EchoSkorJjj
phpSysInfo has an IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers High
CVE-2026-55584 was published for phpsysinfo/phpsysinfo (Composer) Aug 28, 2026
mirackayikci Credited to mirackayikci
AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching Critical
CVE-2026-49757 was published for ash_authentication (Erlang) Aug 25, 2026
jimsynz Credited to jimsynz, maennchen, and jarlah maennchen maennchen
jarlah jarlah
Duplicate Advisory: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port prox High
GHSA-8wx9-j7j5-h9vp was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Statamic: Account takeover via OAuth email matching without email-verification check High
CVE-2026-64665 was published for statamic/cms (Composer) Aug 6, 2026
luuhung1217 Credited to luuhung1217
Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth High
CVE-2026-54763 was published for github.com/traefik/traefik/v2 (Go) Aug 6, 2026
matte1782 Credited to matte1782
Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel Moderate
CVE-2026-49446 was published for github.com/azukaar/cosmos-server (Go) Jul 28, 2026
Dredsen Credited to Dredsen
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database