Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

121 advisories

Loading
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) Low
CVE-2026-115730 was published for i18next-http-backend (npm) Oct 28, 2026
zachariah-mithani Credited to zachariah-mithani
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string Low
CVE-2026-118258 was published for i18next-http-backend (npm) Oct 28, 2026
adriank31 Credited to adriank31
Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) Low
GHSA-w47m-j727-m843 was published for i18next-http-backend (npm) Oct 23, 2026 • withdrawn
i18next-http-backend incomplete URL validation permits SSRF Low
CVE-2026-105800 was published for i18next-http-backend (npm) Oct 6, 2026
avrlab233 Credited to avrlab233
Axios: Header Injection via Inherited headers After Minimal Interceptor Moderate
CVE-2026-101904 was published for axios (npm) Sep 30, 2026
0xEr3n Credited to 0xEr3n
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders Moderate
CVE-2026-101900 was published for axios (npm) Sep 30, 2026
0xEr3n Credited to 0xEr3n
MeshCentral has unsanitized data fields High
GHSA-c7hr-448w-65px was published for meshcentral (npm) Aug 18, 2026
kevthehermit Credited to kevthehermit
Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props High
CVE-2026-71320 was published for nuxt (npm) Aug 5, 2026
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields Moderate
CVE-2026-16729 was published for undici (npm) Aug 3, 2026
Zelys-DFKH Credited to Zelys-DFKH, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
hashi-vault-js has a path traversal and query parameter injection High
CVE-2026-55100 was published for hashi-vault-js (npm) Jul 31, 2026
Sebasteuo Credited to Sebasteuo
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies High
CVE-2026-54666 was published for swagger-typescript-api (npm) Jul 29, 2026
thegr1ffyn Credited to thegr1ffyn
swagger-typescript-api vulnerable to code injection via unescaped enum string values High
CVE-2026-54664 was published for swagger-typescript-api (npm) Jul 29, 2026
thegr1ffyn Credited to thegr1ffyn
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template High
CVE-2026-54661 was published for swagger-typescript-api (npm) Jul 29, 2026
thegr1ffyn Credited to thegr1ffyn
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template High
CVE-2026-54662 was published for swagger-typescript-api (npm) Jul 29, 2026
thegr1ffyn Credited to thegr1ffyn
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection High
CVE-2026-42334 was published for mongoose (npm) May 5, 2026
cataliniovita-snyk Credited to cataliniovita-snyk and katzj katzj katzj
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection Moderate
CVE-2026-44455 was published for hono (npm) May 6, 2026
TarPeg007 Credited to TarPeg007
i18next-locize-backend has URL Injection via Unsanitized Path Parameters Moderate
CVE-2026-41885 was published for i18next-locize-backend (npm) Apr 22, 2026
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns Moderate
CVE-2026-41691 was published for i18next-http-backend (npm) Apr 22, 2026
Hono has CSS Declaration Injection via Style Object Values in JSX SSR Moderate
CVE-2026-44458 was published for hono (npm) May 9, 2026
Gayang2902 Credited to Gayang2902
@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection') Moderate
CVE-2026-35515 was published for @nestjs/core (npm) Apr 6, 2026
aleister1102 Credited to aleister1102
Quill is vulnerable to XSS via HTML export feature Low
CVE-2025-15056 was published for quill (npm) Jan 13, 2026
awwaiid mcp-server-taskwarrior vulnerable to command injection Low
CVE-2026-5833 was published for mcp-server-taskwarrior (npm) Apr 9, 2026
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows Moderate
CVE-2026-34773 was published for electron (npm) Apr 3, 2026
Electron: HTTP Response Header Injection in custom protocol handlers and webRequest Moderate
CVE-2026-34767 was published for electron (npm) Apr 3, 2026
fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function Low
CVE-2026-5327 was published for fast-filesystem-mcp (npm) Apr 2, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database