Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

454 advisories

Loading
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) High
CVE-2026-102827 was published for simple-git (npm) Oct 5, 2026
anir0y Credited to anir0y, bilguunbicktivism, cruzryan, the-vibe-dev, D7EAD, dellalibera, gdegrange, CFionaBF, b1ue0ceanRun, Leeziao, internetteletubbie, and arundr0id bilguunbicktivism bilguunbicktivism
cruzryan cruzryan the-vibe-dev the-vibe-dev D7EAD D7EAD dellalibera dellalibera gdegrange gdegrange CFionaBF CFionaBF b1ue0ceanRun b1ue0ceanRun Leeziao Leeziao internetteletubbie internetteletubbie arundr0id arundr0id
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname... High Unreviewed
CVE-2026-116252 was published Oct 30, 2026
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options High
CVE-2026-119282 was published for @nx/gradle (npm) Oct 30, 2026
arkmarta Credited to arkmarta
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of... High Unreviewed
CVE-2026-111504 was published Oct 30, 2026
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials Critical
CVE-2026-61459 was published for mcp-server-kubernetes (npm) Jul 10, 2026
PercevalFox Credited to PercevalFox, devjoinedthechat, and wlassalle724 devjoinedthechat devjoinedthechat
wlassalle724 wlassalle724
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679) High
GHSA-23mf-xhv8-69c2 was published for GitPython (pip) Oct 27, 2026
0xMax-Sec Credited to 0xMax-Sec
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution High
GHSA-f9j4-qggq-h239 was published for GitPython (pip) Oct 27, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration... High Unreviewed
CVE-2026-50056 was published Oct 23, 2026
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted... Critical Unreviewed
CVE-2026-115372 was published Oct 22, 2026
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control... Critical Unreviewed
CVE-2026-111813 was published Oct 21, 2026
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Critical
CVE-2026-112900 was published for Pillow (pip) Oct 21, 2026
HLe4s-kaist Credited to HLe4s-kaist, radarhere, and hugovk radarhere radarhere
hugovk hugovk
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors Moderate
CVE-2026-112944 was published for launch-editor (npm) Oct 20, 2026
0xazanul Credited to 0xazanul and bluwy bluwy bluwy
A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege... High Unreviewed
CVE-2026-104715 was published Oct 16, 2026
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions... Low Unreviewed
CVE-2026-111581 was published Oct 16, 2026
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper... Moderate Unreviewed
CVE-2026-111728 was published Oct 16, 2026
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull(... Critical Unreviewed
CVE-2026-110858 was published Oct 15, 2026
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that... High Unreviewed
CVE-2026-110859 was published Oct 15, 2026
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9... High Unreviewed
CVE-2026-87687 was published Oct 8, 2026
An argument injection vulnerability exists in the configuration management command-line utility... High Unreviewed
CVE-2026-87667 was published Oct 8, 2026
Improper neutralization of argument delimiters in a command ('argument injection') in Windows... High Unreviewed
CVE-2026-97798 was published Oct 13, 2026
Potential arbitrary code execution, under specific configurations. Critical Unreviewed
CVE-2026-92892 was published Oct 13, 2026
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows... Moderate Unreviewed
CVE-2026-109966 was published Oct 13, 2026
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g.,... High Unreviewed
CVE-2026-108963 was published Oct 11, 2026
An authenticated high privilege user can inject arguments in troubleshooting commands resulting... Critical Unreviewed
CVE-2026-107510 was published Oct 8, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database