Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,574
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,522
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

181 advisories

Loading
Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file... Moderate Unreviewed
CVE-2026-34967 was published Aug 25, 2026
GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and... Moderate Unreviewed
CVE-2026-56390 was published Jul 29, 2026
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25... Moderate Unreviewed
CVE-2025-36398 was published Aug 20, 2026
External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue... Moderate Unreviewed
CVE-2026-18751 was published Aug 18, 2026
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability Moderate
CVE-2026-55062 was published for gitlab.com/uniget-org/cli (Go) Aug 17, 2026
0x5t4l1n Credited to 0x5t4l1n and Chris35t Chris35t Chris35t
PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the... Moderate Unreviewed
CVE-2026-17431 was published Aug 13, 2026
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or... Moderate Unreviewed
CVE-2026-17014 was published Aug 9, 2026
A vulnerability in Cisco Firepower Threat Defense (FTD) Software could allow an authenticated,... Moderate Unreviewed
CVE-2021-34761 was published May 24, 2022
Keras: HDF5 virtual datasets can disclose local files Moderate
CVE-2026-12480 was published for keras (pip) Jul 1, 2026
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout() Moderate
GHSA-hh9p-6wh2-4mfc was published for GitPython (pip) Aug 7, 2026
BarakSrour Credited to BarakSrour
A weakness has been identified in TinyAGI 0.0.20. This issue affects the function collectFiles of... Moderate Unreviewed
CVE-2026-19009 was published Aug 6, 2026
A vulnerability was detected in TinyAGI 0.0.20. The affected element is the function... Moderate Unreviewed
CVE-2026-19011 was published Aug 6, 2026
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive() Moderate
GHSA-539m-9xh6-q6rr was published for GitPython (pip) Aug 3, 2026
anir0y Credited to anir0y
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a... Moderate Unreviewed
CVE-2026-15382 was published Jul 30, 2026
proCertum SmartSign opens Certificate Practice Statement (CPS) URI without schema validation. An... Moderate Unreviewed
CVE-2026-57916 was published Jul 27, 2026
ImageMagick: Policy Bypass in concatenate operation due to missing checks Moderate
CVE-2026-55628 was published for Magick.NET-Q16-AnyCPU (NuGet) Jul 24, 2026
rexpository Credited to rexpository
Gitea: Local File Inclusion via file:// URI in Migration Restore Moderate
CVE-2026-58420 was published for gitea.dev (Go) Jul 21, 2026
isa0-gh Credited to isa0-gh and ibrahmsql ibrahmsql ibrahmsql
Gotenberg allows Chromium URL conversion routes to read arbitrary files under /tmp via file:// scheme Moderate
CVE-2026-42597 was published for github.com/gotenberg/gotenberg/v7 (Go) May 7, 2026
adrgs Credited to adrgs and aisafe-bot aisafe-bot aisafe-bot
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.26 and IBM... Moderate Unreviewed
CVE-2026-3602 was published Jun 30, 2026
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read Moderate
CVE-2026-48520 was published for langflow (pip) Jun 16, 2026
vbCrLf Credited to vbCrLf, keval718, and andifilhohub keval718 keval718
andifilhohub andifilhohub
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before... Moderate Unreviewed
CVE-2026-12979 was published Jul 16, 2026
Armeria: External Control of File Name or Path in xDS SDS DataSource Moderate
CVE-2026-11752 was published for com.linecorp.armeria:armeria-xds (Maven) Jun 18, 2026
zzoru Credited to zzoru
External control of file name or path in Microsoft Office SharePoint allows an authorized... Moderate Unreviewed
CVE-2026-54108 was published Jul 14, 2026
An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500... Moderate Unreviewed
CVE-2026-0259 was published May 13, 2026
psd-tools vulnerable to arbitrary file write via smart-object filename Moderate
CVE-2026-49836 was published for psd-tools (pip) Jul 9, 2026
seankohjs Credited to seankohjs and yueyueL yueyueL yueyueL
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database