Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

6,006 advisories

Loading
Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell... Moderate Unreviewed
CVE-2026-81472 was published Oct 28, 2026
Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions... Critical Unreviewed
CVE-2026-104383 was published Oct 28, 2026
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules Critical
CVE-2026-116692 was published for mlflow (pip) Oct 27, 2026
mskca Credited to mskca
Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection')... Critical Unreviewed
CVE-2026-48360 was published Oct 27, 2026
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code... Critical Unreviewed
CVE-2026-104351 was published Oct 27, 2026
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution High
CVE-2026-114053 was published for vllm (pip) Oct 27, 2026
adithyan-ak Credited to adithyan-ak, jperezdealgaba, and DarkLight1337 jperezdealgaba jperezdealgaba
DarkLight1337 DarkLight1337
OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that... High Unreviewed
CVE-2026-116811 was published Oct 27, 2026
The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined... High Unreviewed
CVE-2026-113673 was published Oct 24, 2026
The app/process-api-response-headers action accepts fake Craft API response headers from any... High Unreviewed
CVE-2026-115935 was published Oct 24, 2026
virtualenv: Xonsh activation literals depend on the script decoding codec High
CVE-2026-113718 was published for virtualenv (pip) Oct 23, 2026
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution High
CVE-2026-115895 was published for happy-dom (npm) Oct 23, 2026
viecon Credited to viecon
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl... High Unreviewed
CVE-2025-30045 was published Oct 23, 2026
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically... Critical Unreviewed
CVE-2025-30050 was published Oct 23, 2026
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields:... Critical Unreviewed
CVE-2026-94267 was published Oct 23, 2026
No description provided High Unreviewed
CVE-2026-79887 was published Oct 22, 2026
Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers... Moderate Unreviewed
CVE-2026-115351 was published Oct 22, 2026
Storybook dev server vulnerable to code injection from the local network High
CVE-2026-114126 was published for @storybook/addon-mcp (npm) Oct 22, 2026
KimiSecurityTeam Credited to KimiSecurityTeam, christos-cantina-security, Sidnioulz, and ghengeveld christos-cantina-security christos-cantina-security
Sidnioulz Sidnioulz ghengeveld ghengeveld
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the... Critical Unreviewed
CVE-2021-48016 was published Oct 22, 2026
The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the... Moderate Unreviewed
CVE-2026-103234 was published Oct 22, 2026
In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role... High Unreviewed
CVE-2026-76293 was published Oct 22, 2026
Vitest: Code injection via unauthenticated manual mock registration Moderate
CVE-2026-112949 was published for @vitest/mocker (npm) Oct 21, 2026
sondt99 Credited to sondt99
MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows... High Unreviewed
CVE-2026-92207 was published Oct 21, 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco... High Unreviewed
CVE-2026-76494 was published Oct 21, 2026
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites Critical
CVE-2026-114125 was published for @storybook/addon-mcp (npm) Oct 21, 2026
agent-killjoy Credited to agent-killjoy, Sidnioulz, and ghengeveld Sidnioulz Sidnioulz
ghengeveld ghengeveld
virtualenv activation scripts run code from a path that contains a placeholder name High
CVE-2026-113776 was published for virtualenv (pip) Oct 21, 2026
Kwstubbs Credited to Kwstubbs and gaborbernat gaborbernat gaborbernat
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database