Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,569
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,522
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

515 advisories

Loading
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create()... High Unreviewed
CVE-2026-78679 was published Aug 25, 2026
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing... High Unreviewed
CVE-2026-78675 was published Aug 25, 2026
Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file... Moderate Unreviewed
CVE-2026-34967 was published Aug 25, 2026
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string,... Critical Unreviewed
CVE-2026-56705 was published Aug 25, 2026
3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation High
CVE-2026-55477 was published for github.com/mhsanaei/3x-ui/v2 (Go) Aug 24, 2026
itsamirhn Credited to itsamirhn
exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage()... High Unreviewed
CVE-2026-78208 was published Aug 24, 2026
NLTK versions before 3.10.0 contain a path traversal vulnerability in FramenetCorpusReader and... High Unreviewed
CVE-2026-62385 was published Aug 22, 2026
Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation High
CVE-2026-64679 was published for github.com/runatlantis/atlantis (Go) Aug 21, 2026
shblue21 Credited to shblue21
External Control of File Name or Path in the upload API endpoint of Datiphy Data Management... Critical Unreviewed
CVE-2026-76158 was published Aug 21, 2026
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution High
GHSA-ghvf-qf6h-g8x5 was published for @nocobase/server (npm) Aug 20, 2026
lukehebe Credited to lukehebe
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite... Critical Unreviewed
CVE-2026-16926 was published Aug 20, 2026
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25... Moderate Unreviewed
CVE-2025-36398 was published Aug 20, 2026
claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools High
GHSA-rr55-jp92-8wp2 was published for claude-faf-mcp (npm) Aug 19, 2026
faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools High
GHSA-j4r7-8ph4-43g3 was published for faf-mcp (npm) Aug 19, 2026
grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools High
GHSA-cc2g-gq8c-r332 was published for grok-faf-mcp (npm) Aug 19, 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco... Critical Unreviewed
CVE-2026-20358 was published Aug 19, 2026
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout... High Unreviewed
CVE-2026-76217 was published Aug 19, 2026
phpMyFAQ before 4.1.7 does not adequately sanitize HTML in FAQ answers before generating PDFs via... High Unreviewed
CVE-2026-76210 was published Aug 19, 2026
An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app... High Unreviewed
CVE-2026-67920 was published Aug 18, 2026
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue... Moderate Unreviewed
CVE-2026-18751 was published Aug 18, 2026
grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path... High Unreviewed
CVE-2026-75830 was published Aug 18, 2026
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability Moderate
CVE-2026-55062 was published for gitlab.com/uniget-org/cli (Go) Aug 17, 2026
0x5t4l1n Credited to 0x5t4l1n and Chris35t Chris35t Chris35t
openssl_encrypt versions before 1.4.0 contain a path traversal vulnerability in the _is_safe_path... High Unreviewed
CVE-2026-74884 was published Aug 17, 2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code... Critical Unreviewed
CVE-2026-17184 was published Aug 14, 2026
External control of file name or path vulnerability in Johnson Controls Airwall allows : File... High Unreviewed
CVE-2026-34492 was published Aug 14, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database