Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

60 advisories

Loading
Docling imports plugin entry points before the allow_external_plugins check Moderate
CVE-2026-105745 was published for docling (pip) Oct 7, 2026
hypnguyen1209 Credited to hypnguyen1209
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to... Moderate Unreviewed
CVE-2026-96443 was published Sep 23, 2026
Microsoft Security Advisory CVE-2026-62902 – .NET Information Disclosure Vulnerability Moderate
CVE-2026-62902 was published for Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Aug 11, 2026
Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass) Moderate
CVE-2026-73851 was published for Microsoft.OpenApi.Kiota (NuGet) Jul 24, 2026
gavinbarron Credited to gavinbarron, gn00295120, and BarakSrour gn00295120 gn00295120
BarakSrour BarakSrour
NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper... Moderate Unreviewed
CVE-2026-24226 was published Jul 14, 2026
Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed... Moderate Unreviewed
CVE-2026-13751 was published Jun 29, 2026
containerd: CRI checkpoint import allows local image tag poisoning Moderate
CVE-2026-50195 was published for github.com/containerd/containerd/v2 (Go) Jun 19, 2026
hbeberman Credited to hbeberman and robertprast robertprast robertprast
Pi Agent: Pi loads project-local extensions without approval Moderate
CVE-2026-54325 was published for @earendil-works/pi-coding-agent (npm) Jun 17, 2026
qerogram Credited to qerogram, urianpaul94, EQSTLab, kamalmarhubi, and useworld urianpaul94 urianpaul94
EQSTLab EQSTLab kamalmarhubi kamalmarhubi useworld useworld
Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-controlled message IDs Moderate
CVE-2026-45711 was published for github.com/axllent/mailpit (Go) May 19, 2026
KadirArslan Credited to KadirArslan
Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config Moderate
GHSA-p3m6-jr2h-hhxj was published for openclaw (npm) May 11, 2026 • withdrawn
Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project... Moderate Unreviewed
CVE-2026-45184 was published May 10, 2026
CSS Parser: Improper Certificate Validation allows MITM injection of remote CSS content Moderate
CVE-2026-44312 was published for css_parser (RubyGems) May 7, 2026
JLLeitschuh Credited to JLLeitschuh
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere Moderate
CVE-2026-42510 was published for ironic (pip) Apr 28, 2026
pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere Moderate
CVE-2026-6357 was published for pip (pip) Apr 27, 2026
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config Moderate
CVE-2026-44995 was published for openclaw (npm) Apr 25, 2026
garagon Credited to garagon
Duplicate Advisory: OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup Moderate
GHSA-m563-373q-885c was published for openclaw (npm) Apr 24, 2026 • withdrawn
In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC... Moderate Unreviewed
CVE-2026-41253 was published Apr 18, 2026
OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup Moderate
CVE-2026-41295 was published for openclaw (npm) Apr 7, 2026
zpbrent Credited to zpbrent
OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup Moderate
CVE-2026-41355 was published for openclaw (npm) Apr 7, 2026
tdjackey Credited to tdjackey
HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability where an attacker... Moderate Unreviewed
CVE-2025-55273 was published Mar 26, 2026
OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL Moderate
CVE-2026-22217 was published for openclaw (npm) Mar 3, 2026
tdjackey Credited to tdjackey
Mattermost Desktop App versions <=5.13.3 fail to attach listeners restricting navigation to... Moderate Unreviewed
CVE-2026-1628 was published Mar 2, 2026
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)... Moderate Unreviewed
CVE-2026-26079 was published Feb 11, 2026
Sony BRAVIA Digital Signage 1.7.8 contains a remote file inclusion vulnerability that allows... Moderate Unreviewed
CVE-2020-36924 was published Jan 6, 2026
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the... Moderate Unreviewed
CVE-2020-36905 was published Jan 6, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database