Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,583
Rust
21

229 advisories

Loading
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of... Moderate Unreviewed
CVE-2026-111501 was published Oct 30, 2026
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password,... Moderate Unreviewed
CVE-2026-22114 was published Oct 30, 2026
Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and... Moderate Unreviewed
CVE-2026-15586 was published Oct 27, 2026
The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second... Moderate Unreviewed
CVE-2026-107145 was published Oct 27, 2026
A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function... Moderate Unreviewed
CVE-2026-116123 was published Oct 26, 2026
ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing Moderate
CVE-2026-113710 was published for apostrophe (npm) Oct 20, 2026
thotamurari Credited to thotamurari
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when... Moderate Unreviewed
CVE-2024-2323 was published Oct 20, 2026
phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user... Moderate Unreviewed
CVE-2026-111892 was published Oct 17, 2026
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better... Moderate Unreviewed
CVE-2026-110861 was published Oct 15, 2026
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to... Moderate Unreviewed
CVE-2026-18318 was published Oct 13, 2026
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts... Moderate Unreviewed
CVE-2026-108580 was published Oct 10, 2026
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because... Moderate Unreviewed
CVE-2026-108163 was published Oct 10, 2026
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords Moderate
CVE-2026-91973 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Payload: Unauthenticated account-lockout denial of service Moderate
CVE-2026-105866 was published for payload (npm) Oct 7, 2026
nhattanhh Credited to nhattanhh
Improper Restriction of Excessive Authentication Attempts in the administration login of... Moderate Unreviewed
CVE-2026-37603 was published Sep 22, 2026
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service Moderate
CVE-2026-77561 was published for github.com/steveiliop56/tinyauth (Go) Sep 22, 2026
sondt99 Credited to sondt99
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header Moderate
CVE-2026-56682 was published for 9router (npm) Sep 22, 2026
b401t Credited to b401t
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` Moderate
CVE-2026-58271 was published for @sync-in/server (npm) Sep 22, 2026
SakusenSec Credited to SakusenSec and johaven johaven johaven
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability... Moderate Unreviewed
CVE-2026-56592 was published Sep 18, 2026
AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to... Moderate Unreviewed
CVE-2026-92583 was published Sep 17, 2026
By default, Payara Server does not limit the number of failed login attempts, which can leave it... Moderate Unreviewed
CVE-2026-92082 was published Sep 15, 2026
A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access... Moderate Unreviewed
CVE-2026-88770 was published Sep 10, 2026
In Audio HAL, there is a possible escalation of privilege due to improper input validation. This... Moderate Unreviewed
CVE-2026-20512 was published Sep 7, 2026
In Audio HAL, there is a possible information disclosure due to a missing permission check. This... Moderate Unreviewed
CVE-2026-20514 was published Sep 7, 2026
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing... Moderate Unreviewed
CVE-2026-86186 was published Sep 5, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database