Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

5,068 advisories

Loading
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto Moderate
CVE-2026-118658 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
Den-Sec Credited to Den-Sec
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory High
CVE-2026-118761 was published for github.com/kubeflow/pipelines (Go) Oct 30, 2026
bugbunny-research Credited to bugbunny-research
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs High
CVE-2026-118759 was published for github.com/kubeflow/pipelines (Go) Oct 30, 2026
bugbunny-research Credited to bugbunny-research
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads Moderate
CVE-2026-119285 was published for github.com/gofiber/fiber/v2 (Go) Oct 30, 2026
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution Critical
GHSA-hff9-5pqw-6w9f was published for github.com/imgproxy/imgproxy (Go) Oct 30, 2026
mateofumis Credited to mateofumis, JasonPuglisi, and JacobBrackett JasonPuglisi JasonPuglisi
JacobBrackett JacobBrackett
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash High
GHSA-494m-4556-wf5p was published for github.com/imgproxy/imgproxy/v3 (Go) Oct 30, 2026
haileyok Credited to haileyok
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field High
GHSA-mmq5-xm89-9pfg was published for github.com/imgproxy/imgproxy/v3 (Go) Oct 30, 2026
haileyok Credited to haileyok
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS Moderate
GHSA-2wrx-84qj-4pcg was published for github.com/anacrolix/torrent (Go) Oct 30, 2026
Reload3d Credited to Reload3d
Buildah allows arbitrary directory mount Moderate
CVE-2024-9675 was published for github.com/containers/buildah (Go) Oct 9, 2024
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users Moderate
GHSA-f3fj-9625-rv3m was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories Moderate
GHSA-fgxm-5hvv-x4vh was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99 and Xiaoyiyi23 Xiaoyiyi23 Xiaoyiyi23
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials High
CVE-2026-62290 was published for github.com/cert-manager/cert-manager (Go) Oct 29, 2026
kamil-sawicki Credited to kamil-sawicki, robertprast, and EQSTLab robertprast robertprast
EQSTLab EQSTLab
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware High
CVE-2026-62160 was published for github.com/daptin/daptin (Go) Oct 29, 2026
tonghuaroot Credited to tonghuaroot
esm.sh has File Inclusion issue High
CVE-2025-59341 was published for github.com/esm-dev/esm.sh (Go) Sep 17, 2025
j3ssie Credited to j3ssie and A11riseforme A11riseforme A11riseforme
esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header Moderate
CVE-2025-59342 was published for github.com/esm-dev/esm.sh (Go) Sep 17, 2025
j3ssie Credited to j3ssie and A11riseforme A11riseforme A11riseforme
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion Moderate
GHSA-2hw4-c9m4-f2fj was published for knative.dev/pkg (Go) Oct 28, 2026
tonghuaroot Credited to tonghuaroot
Go JOSE: Panics in JSON parsing Moderate
CVE-2026-116586 was published for github.com/go-jose/go-jose/v3 (Go) Oct 28, 2026
Go JOSE: Panic during CBC-HMAC processing Moderate
CVE-2026-116585 was published for github.com/go-jose/go-jose/v3 (Go) Oct 28, 2026
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers Moderate
CVE-2026-118657 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
sergeykochanov Credited to sergeykochanov, bugbunny-research, and lalalala5678 bugbunny-research bugbunny-research
lalalala5678 lalalala5678
Echo static file middleware route protection bypass via encoded dot-dot traversal Moderate
CVE-2026-118654 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
DavidCarliez Credited to DavidCarliez and kta1kri kta1kri kta1kri
Echo has a Static Middleware Double-Unescape Path Traversal Moderate
CVE-2026-118655 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI Moderate
CVE-2026-118656 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
zerovulnlabs Credited to zerovulnlabs
Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path High
CVE-2026-118650 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
Adobodoo Credited to Adobodoo, manus-use, kta1kri, zerovulnlabs, and benzdeus manus-use manus-use
kta1kri kta1kri zerovulnlabs zerovulnlabs benzdeus benzdeus
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob Moderate
CVE-2026-118652 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
blitzkrieg-patch Credited to blitzkrieg-patch and Sengtocxoen Sengtocxoen Sengtocxoen
Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration Moderate
CVE-2026-118653 was published for github.com/labstack/echo/v4 (Go) Oct 28, 2026
bugbunny-research Credited to bugbunny-research
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database