Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

155 advisories

Loading
Axios: Header Injection via Inherited headers After Minimal Interceptor Moderate
CVE-2026-101904 was published for axios (npm) Sep 30, 2026
0xEr3n Credited to 0xEr3n
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders Moderate
CVE-2026-101900 was published for axios (npm) Sep 30, 2026
0xEr3n Credited to 0xEr3n
Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter Moderate
CVE-2026-49098 was published for org.apache.camel:camel-kafka (Maven) Jul 6, 2026
oscerd Credited to oscerd
Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter Moderate
CVE-2026-49099 was published for org.apache.camel:camel-salesforce (Maven) Jul 6, 2026
oscerd Credited to oscerd
aiosmtplib: STARTTLS response injection Moderate
CVE-2026-55558 was published for aiosmtplib (pip) Aug 27, 2026
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields Moderate
CVE-2026-54543 was published for froxlor/froxlor (Composer) Aug 18, 2026
YHalo-wyh Credited to YHalo-wyh
undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields Moderate
CVE-2026-16729 was published for undici (npm) Aug 3, 2026
Zelys-DFKH Credited to Zelys-DFKH, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
hermes-agent has an Injection issue Moderate
CVE-2026-10221 was published for hermes-agent (pip) Jun 1, 2026
KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping Moderate
CVE-2026-53572 was published for github.com/kedacore/keda/v2 (Go) Jul 7, 2026
mert2m Credited to mert2m
WeasyPrint has CSS Injection via Presentational Hints Moderate
CVE-2026-49452 was published for weasyprint (pip) Jul 6, 2026
AyushParkara Credited to AyushParkara
hermes-agent has an Injection issue Moderate
CVE-2026-9366 was published for hermes-agent (pip) May 26, 2026
hermes-agent has an Injection issue Moderate
CVE-2026-9353 was published for hermes-agent (pip) May 26, 2026
canto-saas-api: Authenticated API requests can be redirected via unencoded path variables Moderate
CVE-2026-55374 was published for jleehr/canto-saas-api (Composer) Jun 19, 2026
jleehr Credited to jleehr
opentelemetry-collector-contrib sentryexporter: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token Moderate
CVE-2026-47256 was published for github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter (Go) Jun 18, 2026
brodmart Credited to brodmart
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch Moderate
CVE-2026-47767 was published for symfony/runtime (Composer) Jun 9, 2026
nicolas-grekas Credited to nicolas-grekas and 0xEr3n 0xEr3n 0xEr3n
Improper Input Validation and Injection in Apache Log4j2 Moderate
CVE-2021-44832 was published for org.apache.logging.log4j:log4j-core (Maven) Jan 4, 2022
ppkarwasz Credited to ppkarwasz
org.linlinjava:litemall-wx-api has an Injection issue Moderate
CVE-2026-8771 was published for org.linlinjava:litemall-wx-api (Maven) May 18, 2026
hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection Moderate
CVE-2026-44455 was published for hono (npm) May 6, 2026
TarPeg007 Credited to TarPeg007
Rails Active Storage has possible glob injection in its DiskService Moderate
CVE-2026-33202 was published for activestorage (RubyGems) Mar 23, 2026
i18next-locize-backend has URL Injection via Unsanitized Path Parameters Moderate
CVE-2026-41885 was published for i18next-locize-backend (npm) Apr 22, 2026
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns Moderate
CVE-2026-41691 was published for i18next-http-backend (npm) Apr 22, 2026
Hono has CSS Declaration Injection via Style Object Values in JSX SSR Moderate
CVE-2026-44458 was published for hono (npm) May 9, 2026
Gayang2902 Credited to Gayang2902
SGLang has an Improper Input Validation/Injection Issue Moderate
CVE-2026-7669 was published for sglang (pip) May 3, 2026
PicoClaw has an Injection issue in its Web Launcher Management Plane component Moderate
CVE-2026-6987 was published for github.com/sipeed/picoclaw (Go) Apr 25, 2026
sqlite-mcp has an Injection issue Moderate
CVE-2026-7206 was published for sqlite-mcp (pip) Apr 28, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database