Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

85 advisories

Loading
Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer... Moderate Unreviewed
CVE-2026-66392 was published Oct 21, 2026
A flaw in the curl command line tool's logic makes it only set SSH host verification options when... High Unreviewed
CVE-2026-86410 was published Oct 20, 2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not... High Unreviewed
CVE-2026-85974 was published Oct 12, 2026
In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did... Critical Unreviewed
CVE-2026-107938 was published Oct 9, 2026
A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the Common Name... Critical Unreviewed
CVE-2026-88647 was published Oct 8, 2026
FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation... Moderate Unreviewed
CVE-2026-107660 was published Oct 8, 2026
Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks High
GHSA-5wf9-h793-w73c was published for github.com/xtls/xray-core (Go) Oct 2, 2026
Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat... Moderate Unreviewed
CVE-2026-102669 was published Oct 1, 2026
ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl... High Unreviewed
CVE-2026-19553 was published Sep 30, 2026
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing Critical
CVE-2026-63374 was published for anyio (pip) Sep 18, 2026
Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments.... High Unreviewed
CVE-2026-59969 was published Sep 16, 2026
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... High Unreviewed
CVE-2026-79636 was published Sep 9, 2026
A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1... High Unreviewed
CVE-2026-84393 was published Sep 8, 2026
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... Moderate Unreviewed
CVE-2026-79943 was published Sep 7, 2026
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates... Moderate Unreviewed
CVE-2026-9744 was published Sep 3, 2026
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the... Moderate Unreviewed
CVE-2026-59272 was published Aug 27, 2026
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions... High Unreviewed
CVE-2026-62243 was published Aug 22, 2026
TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are... High Unreviewed
CVE-2026-65942 was published Aug 10, 2026
IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim... Low Unreviewed
CVE-2026-12730 was published Aug 5, 2026
In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default... Critical Unreviewed
CVE-2026-59638 was published Aug 3, 2026
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname... Moderate Unreviewed
CVE-2026-58040 was published Jul 30, 2026
Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit Moderate
CVE-2026-66053 was published for thrift (pip) Jul 27, 2026
carlosfunk Credited to carlosfunk and oscerd oscerd oscerd
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib... Critical Unreviewed
CVE-2026-48144 was published Jul 27, 2026
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings... High Unreviewed
CVE-2026-48145 was published Jul 27, 2026
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the... High Unreviewed
CVE-2026-15243 was published Jul 24, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database