Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

646 advisories

Loading
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679) High
GHSA-23mf-xhv8-69c2 was published for GitPython (pip) Oct 27, 2026
0xMax-Sec Credited to 0xMax-Sec
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment High
GHSA-j456-xh4h-cpf2 was published for nltk (pip) Oct 27, 2026
manus-use Credited to manus-use
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows... Moderate Unreviewed
CVE-2026-116822 was published Oct 27, 2026
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels... Critical Unreviewed
CVE-2026-115931 was published Oct 24, 2026
A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the... Moderate Unreviewed
CVE-2026-114379 was published Oct 21, 2026
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images... Moderate Unreviewed
CVE-2026-114491 was published Oct 21, 2026
A vulnerability was determined in oretnom23 file-management-system-php up to... Low Unreviewed
CVE-2026-114253 was published Oct 21, 2026
External control of file name or path and uncontrolled resource consumption in Apache bRPC ... Unknown Unreviewed
CVE-2026-86147 was published Oct 21, 2026
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo Moderate
GHSA-pcc4-rvhr-2pr8 was published for graphifyy (pip) Oct 19, 2026
aeonframework Credited to aeonframework
NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image... Low Unreviewed
CVE-2026-111935 was published Oct 19, 2026
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered,... Critical Unreviewed
CVE-2026-105037 was published Oct 15, 2026
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed... High Unreviewed
CVE-2026-111234 was published Oct 15, 2026
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with... Moderate Unreviewed
CVE-2026-111230 was published Oct 15, 2026
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path... Critical Unreviewed
CVE-2026-107594 was published Oct 14, 2026
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows... High Unreviewed
CVE-2026-110385 was published Oct 14, 2026
External control of file name or path in Windows Update allows an authorized attacker to elevate... High Unreviewed
CVE-2026-69783 was published Oct 13, 2026
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4... Critical Unreviewed
CVE-2026-106042 was published Oct 13, 2026
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read... High Unreviewed
CVE-2026-109601 was published Oct 13, 2026
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated... High Unreviewed
CVE-2026-108694 was published Oct 11, 2026
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated... Moderate Unreviewed
CVE-2026-108591 was published Oct 10, 2026
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in... Moderate Unreviewed
CVE-2026-108156 was published Oct 9, 2026
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory High
CVE-2026-107377 was published for datamodel-code-generator (pip) Oct 8, 2026
alex131125 Credited to alex131125
PraisonAI: Project config can auto-save agent output outside the project root Moderate
CVE-2026-60089 was published for praisonaiagents (pip) Oct 8, 2026
rexpository Credited to rexpository
An arbitrary file manipulation vulnerability exists in the WebTools management interface of... High Unreviewed
CVE-2026-87685 was published Oct 8, 2026
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine High
CVE-2026-105744 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff, hoanggxyuuki, Smavl, 3m4n5, and Jiayang-Lai hoanggxyuuki hoanggxyuuki
Smavl Smavl 3m4n5 3m4n5 Jiayang-Lai Jiayang-Lai
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database