Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

526 advisories

Loading
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) High
CVE-2026-114616 was published for Authlib (pip) Oct 27, 2026
clzoom Credited to clzoom, tonghuaroot, and ksanjeev284 tonghuaroot tonghuaroot
ksanjeev284 ksanjeev284
A security vulnerability has been detected in SH3. This affects an unknown function of the... Low Unreviewed
CVE-2026-116054 was published Oct 25, 2026
The Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens... Moderate Unreviewed
CVE-2026-105996 was published Oct 21, 2026
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of... Low Unreviewed
CVE-2026-112029 was published Oct 19, 2026
A security vulnerability has been detected in light0011 cms... Low Unreviewed
CVE-2026-112026 was published Oct 19, 2026
Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is... High Unreviewed
CVE-2026-35088 was published Oct 15, 2026
Inadequate encryption strength in Windows Virtualization-Based Security (VBS) Enclave allows an... Moderate Unreviewed
CVE-2026-83885 was published Oct 13, 2026
The Booking Calendar WordPress plugin before 11.8 does not generate its per-booking access hashes... Moderate Unreviewed
CVE-2026-105193 was published Oct 8, 2026
A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file... Low Unreviewed
CVE-2026-105156 was published Oct 4, 2026
Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when... High Unreviewed
CVE-2026-82356 was published Sep 23, 2026
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser Critical
CVE-2026-77405 was published for github.com/rabbitmq/amqp091-go (Go) Sep 17, 2026
suchitd Credited to suchitd
The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key... Moderate Unreviewed
CVE-2026-86824 was published Sep 17, 2026
A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of... Low Unreviewed
CVE-2026-86670 was published Sep 8, 2026
Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites ... Critical Unreviewed
CVE-2023-54356 was published Sep 1, 2026
The Newsletters WordPress plugin before 4.17 does not generate its API key using a sufficiently... Moderate Unreviewed
CVE-2026-17520 was published Aug 29, 2026
openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100... High Unreviewed
CVE-2026-81718 was published Aug 27, 2026
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV... Moderate Unreviewed
CVE-2026-47842 was published Aug 26, 2026
Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0... Moderate Unreviewed
CVE-2026-79084 was published Aug 25, 2026
openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key... Critical Unreviewed
CVE-2026-74889 was published Aug 17, 2026
Inadequate encryption strength in Windows Active Directory allows an authorized attacker to... Moderate Unreviewed
CVE-2026-65777 was published Aug 11, 2026
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary... High Unreviewed
CVE-2026-9201 was published Aug 5, 2026
In Bouncy Castle for Java before 1.85, BKS keystore accepts legacy version with 16-bit integrity... High Unreviewed
CVE-2026-59651 was published Aug 3, 2026
Use of an insecure cryptographic algorithm in the cashless payment system using NFC wristbands... Moderate Unreviewed
CVE-2026-4648 was published Jul 28, 2026
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength... High Unreviewed
CVE-2026-50044 was published Jul 24, 2026
HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of... Critical Unreviewed
CVE-2024-23564 was published Jul 17, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database