Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,575
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,523
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

72 advisories

Loading
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string,... Critical Unreviewed
CVE-2026-56705 was published Aug 25, 2026
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management... Critical Unreviewed
CVE-2026-76158 was published Aug 21, 2026
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite... Critical Unreviewed
CVE-2026-16926 was published Aug 20, 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco... Critical Unreviewed
CVE-2026-20358 was published Aug 19, 2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code... Critical Unreviewed
CVE-2026-17184 was published Aug 14, 2026
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated... Critical Unreviewed
CVE-2026-72842 was published Aug 14, 2026
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload,... Critical Unreviewed
CVE-2026-72841 was published Aug 14, 2026
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary... Critical Unreviewed
CVE-2026-17482 was published Aug 13, 2026
DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field... Critical Unreviewed
CVE-2026-72742 was published Aug 11, 2026
The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not... Critical Unreviewed
CVE-2026-16054 was published Aug 6, 2026
Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules) Critical
CVE-2026-67429 was published for flyto-core (pip) Jul 30, 2026
kaimandalic Credited to kaimandalic
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway Critical
GHSA-68r5-9hpg-7qw9 was published for org.openidentityplatform.opendj:opendj-dsml-servlet (Maven) Jul 24, 2026
manus-use Credited to manus-use
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode Critical
CVE-2026-50006 was published for github.com/julien040/anyquery (Go) Jul 14, 2026
Metincloup Credited to Metincloup
mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that... Critical Unreviewed
CVE-2026-61462 was published Jul 13, 2026
Mautic vulnerable to Path Traversal via Campaign Import Critical
CVE-2026-9559 was published for mautic/core (Composer) Jul 2, 2026
nglong05 Credited to nglong05, f3nrir77, escopecz, patrykgruszka, and LeuchtfeuerDigitalMarketing f3nrir77 f3nrir77
escopecz escopecz patrykgruszka patrykgruszka LeuchtfeuerDigitalMarketing LeuchtfeuerDigitalMarketing
The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File... Critical Unreviewed
CVE-2026-6070 was published Jul 1, 2026
Incus has an arbitrary file write via path traversal in S3 multipart upload Critical
CVE-2026-48753 was published for github.com/lxc/incus/v7/cmd/incusd (Go) Jun 26, 2026
antifob Credited to antifob and stgraber stgraber stgraber
Incus has arbitrary file read+write on host via templates/ symlink in malicious image Critical
CVE-2026-48752 was published for github.com/lxc/incus/v7/cmd/incusd (Go) Jun 26, 2026
antifob Credited to antifob and stgraber stgraber stgraber
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image Critical
CVE-2026-48750 was published for github.com/lxc/incus/v7/cmd/incusd (Go) Jun 26, 2026
antifob Credited to antifob and stgraber stgraber stgraber
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image Critical
CVE-2026-48749 was published for github.com/lxc/incus/v7/cmd/incusd (Go) Jun 26, 2026
antifob Credited to antifob and stgraber stgraber stgraber
Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access... Critical Unreviewed
CVE-2025-71334 was published Jun 26, 2026
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process... Critical Unreviewed
CVE-2025-71338 was published Jun 26, 2026
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api... Critical Unreviewed
CVE-2025-71333 was published Jun 26, 2026
An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the... Critical Unreviewed
CVE-2026-39006 was published Jun 15, 2026
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open()... Critical Unreviewed
CVE-2026-11526 was published Jun 14, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database