Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,581
Rust
21

96 advisories

Loading
mcp-server-kubernetes argument injection can expose Kubernetes cluster credentials Critical
CVE-2026-61459 was published for mcp-server-kubernetes (npm) Jul 10, 2026
PercevalFox Credited to PercevalFox, devjoinedthechat, and wlassalle724 devjoinedthechat devjoinedthechat
wlassalle724 wlassalle724
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted... Critical Unreviewed
CVE-2026-115372 was published Oct 22, 2026
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control... Critical Unreviewed
CVE-2026-111813 was published Oct 21, 2026
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Critical
CVE-2026-112900 was published for Pillow (pip) Oct 21, 2026
HLe4s-kaist Credited to HLe4s-kaist, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull(... Critical Unreviewed
CVE-2026-110858 was published Oct 15, 2026
Potential arbitrary code execution, under specific configurations. Critical Unreviewed
CVE-2026-92892 was published Oct 13, 2026
An authenticated high privilege user can inject arguments in troubleshooting commands resulting... Critical Unreviewed
CVE-2026-107510 was published Oct 8, 2026
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value... Critical Unreviewed
CVE-2026-24061 was published Jan 21, 2026
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting:... Critical Unreviewed
CVE-2026-100714 was published Sep 26, 2026
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project... Critical Unreviewed
CVE-2026-84502 was published Sep 23, 2026
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated... Critical Unreviewed
CVE-2026-87900 was published Sep 23, 2026
An authenticated, low-privileged user with access to the NetBackup Flex OS management shell... Critical Unreviewed
CVE-2026-28197 was published Sep 18, 2026
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin... Critical Unreviewed
CVE-2026-86060 was published Sep 5, 2026
GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE Critical
CVE-2026-78676 was published for GitPython (pip) Sep 8, 2026
Pig-Tail Credited to Pig-Tail
Duplicate Advisory: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE Critical
GHSA-9557-234j-7rv9 was published for GitPython (pip) Aug 25, 2026 • withdrawn
Semaphore U: OS Command Injection Critical
CVE-2026-73294 was published for github.com/semaphoreui/semaphore (Go) Sep 8, 2026
faran1512 Credited to faran1512
Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects... Critical Unreviewed
CVE-2026-71377 was published Sep 8, 2026
NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) Critical
CVE-2026-79675 was published for nltk (pip) Sep 1, 2026
arpitjain099 Credited to arpitjain099
Duplicate Advisory: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841) Critical
GHSA-3h2g-j4wp-7qqq was published for nltk (pip) Aug 25, 2026 • withdrawn
Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer Critical
CVE-2026-40047 was published for org.apache.camel:camel-docling (Maven) Jul 6, 2026
oscerd Credited to oscerd
Improper neutralization of argument delimiters in a command ('argument injection') in Azure... Critical Unreviewed
CVE-2026-65770 was published Aug 21, 2026
Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue... Critical Unreviewed
CVE-2026-73240 was published Aug 12, 2026
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags... Critical Unreviewed
CVE-2026-16770 was published Aug 13, 2026
n8n Has an Arbitrary File Read via Git Node Critical
CVE-2026-44790 was published for n8n (npm) May 14, 2026
simonkoeck Credited to simonkoeck
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database