Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

8,048 advisories

Loading
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function High
CVE-2026-106764 was published for @rog0x/mcp-git-tools (npm) Oct 23, 2026
stillmarcus24 Credited to stillmarcus24
@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions High
CVE-2026-106763 was published for @justice8096/sagemath-mcp-server (npm) Oct 23, 2026
stillmarcus24 Credited to stillmarcus24
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern High
CVE-2026-33287 was published for liquidjs (npm) Mar 25, 2026
koDove Credited to koDove, mikeflame, and SiteQ8 mikeflame mikeflame
SiteQ8 SiteQ8
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs High
CVE-2026-118664 was published for decode-uri-component (npm) Oct 29, 2026
gdegrange Credited to gdegrange
Vite: `server.fs.deny` bypassed with queries Moderate
CVE-2026-118662 was published for vite (npm) Oct 29, 2026
Hama1cco Credited to Hama1cco
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy High
GHSA-w9x9-j56r-h98r was published for @eeacms/volto-chatbot (npm) Oct 29, 2026
EQSTLab Credited to EQSTLab
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence Low
GHSA-c33x-vcv4-vg3g was published for @cedar-policy/cedar-wasm (npm) Oct 29, 2026
john-h-kastner-aws Credited to john-h-kastner-aws and DenizParlak DenizParlak DenizParlak
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY High
CVE-2026-62264 was published for @sylphx/pdf-reader-mcp (npm) Oct 29, 2026
novice-22 Credited to novice-22
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Low
CVE-2026-61448 was published for parse-server (npm) Oct 29, 2026
CyberKareem Credited to CyberKareem and mtrezza mtrezza mtrezza
Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Low
GHSA-p6c5-mjgj-m4rm was published for parse-server (npm) Jul 11, 2026 • withdrawn
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) Moderate
CVE-2026-110816 was published for qs (npm) Oct 27, 2026
manus-pi Credited to manus-pi, Lucidsec, manus-use, and KeenSecurityLab Lucidsec Lucidsec
manus-use manus-use KeenSecurityLab KeenSecurityLab
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) Low
CVE-2026-115730 was published for i18next-http-backend (npm) Oct 28, 2026
zachariah-mithani Credited to zachariah-mithani
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks High
CVE-2026-116576 was published for systeminformation (npm) Oct 28, 2026
itsFM-Codes Credited to itsFM-Codes
Backstage catalog rules can be bypassed for URL locations using encoded path segments Moderate
CVE-2026-115923 was published for @backstage/plugin-catalog-backend (npm) Oct 28, 2026
Waline login accepts a non-string email as a match-all MongoDB query Moderate
GHSA-jf75-q64q-g65r was published for @waline/vercel (npm) Oct 28, 2026
dizconnectz Credited to dizconnectz
Seroval: Code injection through a typed array's own constructor property Moderate
CVE-2026-116583 was published for seroval (npm) Oct 28, 2026
Seroval: Script injection through RegExp sources in serialized output Moderate
CVE-2026-116582 was published for seroval (npm) Oct 28, 2026
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) High
CVE-2026-116581 was published for seroval (npm) Oct 28, 2026
realies Credited to realies
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length High
CVE-2026-116584 was published for seroval (npm) Oct 28, 2026
llegomark Credited to llegomark
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check High
CVE-2026-116580 was published for seroval (npm) Oct 28, 2026
cruzryan Credited to cruzryan
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) Moderate
CVE-2026-116575 was published for mem0ai (npm) Oct 28, 2026
OfficialAbhinavSingh Credited to OfficialAbhinavSingh
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net Low
CVE-2026-116673 was published for systeminformation (npm) Oct 28, 2026
itsFM-Codes Credited to itsFM-Codes
Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses High
CVE-2026-93748 was published for http-cache-semantics (npm) Sep 18, 2026 • withdrawn
mazze93 Credited to mazze93
systeminformation has prototype pollution in `networkStats()` via the interface name Moderate
CVE-2026-116674 was published for systeminformation (npm) Oct 28, 2026
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service High
CVE-2026-115887 was published for graphql-scalars (npm) Oct 28, 2026
pozylon Credited to pozylon, dotansimha, and enisdenjo dotansimha dotansimha
enisdenjo enisdenjo
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database