GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
9 advisories
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
High
GHSA-xcqx-9jf5-w339
was published
for
mcp-searxng
(npm)
Jun 19, 2026
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
High
GHSA-mrvx-jmjw-vggc
was published
for
mcp-searxng
(npm)
Jun 19, 2026
appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)
High
GHSA-x975-rgx4-5fh4
was published
for
appium-mcp
(npm)
Jun 19, 2026
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
High
GHSA-h5x8-xp6m-x6q4
was published
for
@jhb.software/payload-cloudinary-plugin
(npm)
Jun 19, 2026
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
High
CVE-2026-49857
was published
for
auth-fetch-mcp
(npm)
Jul 1, 2026
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
High
CVE-2026-50143
was published
for
@apify/actors-mcp-server
(npm)
Jul 1, 2026
OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
High
CVE-2026-59892
was published
for
@opentelemetry/propagator-jaeger
(npm)
Jul 21, 2026
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
High
CVE-2026-73561
was published
for
@anephenix/hub
(npm)
Jul 24, 2026
`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation
High
GHSA-p7w7-4929-vpj5
was published
for
@dynatrace-oss/dynatrace-mcp-server
(npm)
Jul 31, 2026
ProTip!
Advisories are also available from the
GraphQL API