Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,163
Rust
1,615
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

5,057 advisories

Loading
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion Moderate
GHSA-2hw4-c9m4-f2fj was published for knative.dev/pkg (Go) Oct 28, 2026
tonghuaroot Credited to tonghuaroot
Go JOSE: Panics in JSON parsing Moderate
CVE-2026-116586 was published for github.com/go-jose/go-jose/v3 (Go) Oct 28, 2026
Go JOSE: Panic during CBC-HMAC processing Moderate
CVE-2026-116585 was published for github.com/go-jose/go-jose/v3 (Go) Oct 28, 2026
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers Moderate
CVE-2026-118657 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
sergeykochanov Credited to sergeykochanov, bugbunny-research, and lalalala5678 bugbunny-research bugbunny-research
lalalala5678 lalalala5678
Echo static file middleware route protection bypass via encoded dot-dot traversal Moderate
CVE-2026-118654 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
DavidCarliez Credited to DavidCarliez and kta1kri kta1kri kta1kri
Echo has a Static Middleware Double-Unescape Path Traversal Moderate
CVE-2026-118655 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI Moderate
CVE-2026-118656 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
zerovulnlabs Credited to zerovulnlabs
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto Moderate
CVE-2026-118658 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path High
CVE-2026-118650 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
Adobodoo Credited to Adobodoo, manus-use, kta1kri, zerovulnlabs, and benzdeus manus-use manus-use
kta1kri kta1kri zerovulnlabs zerovulnlabs benzdeus benzdeus
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob Moderate
CVE-2026-118652 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
blitzkrieg-patch Credited to blitzkrieg-patch and Sengtocxoen Sengtocxoen Sengtocxoen
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration Moderate
CVE-2026-118653 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
bugbunny-research Credited to bugbunny-research
Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method Moderate
CVE-2026-118266 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
bugbunny-research Credited to bugbunny-research
Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default Moderate
CVE-2026-118651 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
bugbunny-research Credited to bugbunny-research
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through Low
CVE-2026-55458 was published for github.com/caddyserver/caddy/v2 (Go) Oct 28, 2026
jirn073-76 Credited to jirn073-76
Neko: Authorization bypass in legacy WebRTC input handling Moderate
CVE-2026-116679 was published for github.com/m1k1o/neko/server (Go) Oct 27, 2026
KasperBuilds Credited to KasperBuilds
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan High
CVE-2026-116676 was published for github.com/runatlantis/atlantis (Go) Oct 27, 2026
krewenki Credited to krewenki
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory High
CVE-2026-116682 was published for github.com/gtsteffaniak/filebrowser/backend (Go) Oct 27, 2026
je-lv Credited to je-lv and KasperBuilds KasperBuilds KasperBuilds
Go JOSE: DoS when parsing JWKs that contain RSA keys High
CVE-2026-116587 was published for github.com/go-jose/go-jose/v3 (Go) Oct 27, 2026
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values High
CVE-2026-116683 was published for github.com/ctfer-io/terraform-provider-ctfd (Go) Oct 27, 2026
kta1kri Credited to kta1kri
compress zstd: Panic on two-block frames High
CVE-2026-116591 was published for github.com/klauspost/compress/zstd (Go) Oct 27, 2026
joshua-kim Credited to joshua-kim, StephenButtolph, Morris-be, and chriselbring-avalabs StephenButtolph StephenButtolph
Morris-be Morris-be chriselbring-avalabs chriselbring-avalabs
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files Moderate
CVE-2026-60083 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 27, 2026
alham-rizvi Credited to alham-rizvi
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins High
CVE-2026-34157 was published for github.com/wailsapp/wails/v2 (Go) Oct 27, 2026
Saku0512 Credited to Saku0512
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For Moderate
CVE-2026-114437 was published for github.com/go-chi/chi/v5 (Go) Oct 23, 2026
tenbbughunters Credited to tenbbughunters
Echo: X-Real-IP extractor trusts the header value instead of the sending peer Moderate
CVE-2026-118265 was published for github.com/labstack/echo/v5 (Go) Oct 23, 2026
rm-Umar Credited to rm-Umar and Duodum Duodum Duodum
Echo: WebSocket proxy can retain connections and handlers after client disconnect High
CVE-2026-118262 was published for github.com/labstack/echo/v4 (Go) Oct 23, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database