Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

451 advisories

Loading
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679) High
GHSA-23mf-xhv8-69c2 was published for GitPython (pip) Oct 27, 2026
0xMax-Sec Credited to 0xMax-Sec
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution High
GHSA-f9j4-qggq-h239 was published for GitPython (pip) Oct 27, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration... High Unreviewed
CVE-2026-50056 was published Oct 23, 2026
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted... Critical Unreviewed
CVE-2026-115372 was published Oct 22, 2026
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control... Critical Unreviewed
CVE-2026-111813 was published Oct 21, 2026
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Critical
CVE-2026-112900 was published for Pillow (pip) Oct 21, 2026
HLe4s-kaist Credited to HLe4s-kaist, radarhere, and hugovk radarhere radarhere
hugovk hugovk
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors Moderate
CVE-2026-112944 was published for launch-editor (npm) Oct 20, 2026
0xazanul Credited to 0xazanul and bluwy bluwy bluwy
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions... Low Unreviewed
CVE-2026-111581 was published Oct 16, 2026
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper... Moderate Unreviewed
CVE-2026-111728 was published Oct 16, 2026
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege... High Unreviewed
CVE-2026-104715 was published Oct 16, 2026
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull(... Critical Unreviewed
CVE-2026-110858 was published Oct 15, 2026
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that... High Unreviewed
CVE-2026-110859 was published Oct 15, 2026
Improper neutralization of argument delimiters in a command ('argument injection') in Windows... High Unreviewed
CVE-2026-97798 was published Oct 13, 2026
Potential arbitrary code execution, under specific configurations. Critical Unreviewed
CVE-2026-92892 was published Oct 13, 2026
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows... Moderate Unreviewed
CVE-2026-109966 was published Oct 13, 2026
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g.,... High Unreviewed
CVE-2026-108963 was published Oct 11, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... Low Unreviewed
CVE-2026-11939 was published Oct 8, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... High Unreviewed
CVE-2026-19482 was published Oct 8, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... High Unreviewed
CVE-2026-18740 was published Oct 8, 2026
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection... High Unreviewed
CVE-2026-107639 was published Oct 8, 2026
An authenticated high privilege user can inject arguments in troubleshooting commands resulting... Critical Unreviewed
CVE-2026-107510 was published Oct 8, 2026
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other... High Unreviewed
CVE-2026-93699 was published Oct 8, 2026
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9... High Unreviewed
CVE-2026-87687 was published Oct 8, 2026
An argument injection vulnerability exists in the configuration management command-line utility... High Unreviewed
CVE-2026-87667 was published Oct 8, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database