Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,569
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,522
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

515 advisories

Loading
Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including... High Unreviewed
CVE-2026-15736 was published Jul 14, 2026
mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that... Critical Unreviewed
CVE-2026-61462 was published Jul 13, 2026
A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element... Low Unreviewed
CVE-2026-15540 was published Jul 13, 2026
OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy... High Unreviewed
CVE-2026-14480 was published Jul 11, 2026
mcp-atlassian: Arbitrary server-side file read via attachment upload High
GHSA-wm45-qh3g-v83f was published for mcp-atlassian (pip) Jul 10, 2026
0xmagic0 Credited to 0xmagic0
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS... High Unreviewed
CVE-2026-59793 was published Jul 10, 2026
psd-tools vulnerable to arbitrary file write via smart-object filename Moderate
CVE-2026-49836 was published for psd-tools (pip) Jul 9, 2026
seankohjs Credited to seankohjs and yueyueL yueyueL yueyueL
Rattler vulnerable to package cache path traversal via conda package build string Moderate
CVE-2026-53956 was published for py_rattler (pip) Jul 9, 2026
Phantom: Arbitrary file write and decode-bomb DoS via unconfined MCP tool paths High
GHSA-52vm-mxx8-f227 was published for phantom-audio (pip) Jul 9, 2026
leesaenz Credited to leesaenz
Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows... High Unreviewed
CVE-2026-59807 was published Jul 8, 2026
App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project ... High Unreviewed
CVE-2026-49145 was published Jul 8, 2026
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) Moderate
CVE-2026-53508 was published for github.com/oasdiff/oasdiff (Go) Jul 7, 2026
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File... High Unreviewed
CVE-2026-6101 was published Jul 7, 2026
EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose Moderate
CVE-2026-45016 was published for egroupware/egroupware (Composer) Jul 7, 2026
smitocaru Credited to smitocaru
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized... High Unreviewed
CVE-2026-58293 was published Jul 3, 2026
External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user... High Unreviewed
CVE-2026-8921 was published Jul 3, 2026
Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB High
CVE-2026-49360 was published for recce (pip) Jul 2, 2026
Mautic vulnerable to Path Traversal via Campaign Import Critical
CVE-2026-9559 was published for mautic/core (Composer) Jul 2, 2026
nglong05 Credited to nglong05, f3nrir77, escopecz, patrykgruszka, and LeuchtfeuerDigitalMarketing f3nrir77 f3nrir77
escopecz escopecz patrykgruszka patrykgruszka LeuchtfeuerDigitalMarketing LeuchtfeuerDigitalMarketing
The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up... High Unreviewed
CVE-2026-5821 was published Jul 2, 2026
oras-go has file store write outside workingDir via symlink traversal Moderate
CVE-2026-50162 was published for oras.land/oras-go/v2 (Go) Jul 1, 2026
1seal Credited to 1seal
Keras: HDF5 virtual datasets can disclose local files Moderate
CVE-2026-12480 was published for keras (pip) Jul 1, 2026
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components Moderate
GHSA-2wwr-9x6f-88gp was published for easycorp/easyadmin-bundle (Composer) Jul 1, 2026
The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File... Critical Unreviewed
CVE-2026-6070 was published Jul 1, 2026
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM... Moderate Unreviewed
CVE-2026-3602 was published Jun 30, 2026
Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to... High Unreviewed
CVE-2026-10816 was published Jun 30, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database