Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,556
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,518
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

126 advisories

Loading
Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers Moderate
CVE-2026-63004 was published for unleash-server (npm) Aug 21, 2026
5ud0er Credited to 5ud0er
SearXNG MCP Server: Additional hardened-mode SSRF bypasses Moderate
CVE-2026-54689 was published for mcp-searxng (npm) Aug 19, 2026
SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off) Moderate
CVE-2026-54688 was published for mcp-searxng (npm) Aug 19, 2026
geo-chen Credited to geo-chen
MagicMirror: ssrf calendar .js Moderate
CVE-2026-63643 was published for magicmirror (npm) Aug 18, 2026
gabrie0x6c Credited to gabrie0x6c
MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery Moderate
CVE-2026-63642 was published for magicmirror (npm) Aug 18, 2026
gabrie0x6c Credited to gabrie0x6c
Electron: HTTP redirect followed into local file loader Moderate
CVE-2026-70605 was published for electron (npm) Aug 5, 2026
Ghost: Server-Side Request Forgery Mitigation Issue Moderate
CVE-2026-70595 was published for ghost (npm) Aug 5, 2026
Ghost: Server-Side Request Forgery in Image Fetching Moderate
CVE-2026-70591 was published for ghost (npm) Aug 4, 2026
koyokr Credited to koyokr
Ghost: Mobiledoc image-size fetch SSRF Moderate
CVE-2026-53946 was published for ghost (npm) Aug 4, 2026
Ghost: Server-side request forgery via DNS rebinding in external request handling Moderate
CVE-2026-53945 was published for ghost (npm) Aug 4, 2026
l3tchupkt Credited to l3tchupkt
Ghost: Private IP filtering bypass to make server-side requests to internal services Moderate
CVE-2026-53944 was published for ghost (npm) Aug 4, 2026
l3tchupkt Credited to l3tchupkt
ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks Moderate
CVE-2026-69198 was published for ip-address (npm) Aug 3, 2026
hi-im-glitchless Credited to hi-im-glitchless
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks Moderate
CVE-2026-54272 was published for ip-address (npm) Aug 3, 2026
OV-0-VO Credited to OV-0-VO
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` Moderate
CVE-2026-54663 was published for swagger-typescript-api (npm) Jul 29, 2026
thegr1ffyn Credited to thegr1ffyn
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition Moderate
GHSA-vg6v-j97m-h5xq was published for @novu/application-generic (npm) Jul 28, 2026
b-hermes Credited to b-hermes
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller Moderate
GHSA-8q49-2h5h-434x was published for @frontmcp/adapters (npm) Jul 24, 2026
EchoSkorJjj Credited to EchoSkorJjj and frontegg-david frontegg-david frontegg-david
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation Moderate
CVE-2026-73307 was published for @budibase/server (npm) Jul 24, 2026
oduoke567 Credited to oduoke567
n8n: SSRF Protection Bypass via MCP Client Node Moderate
GHSA-vhf8-cg2h-cg3p was published for n8n (npm) Jul 22, 2026
nil340 Credited to nil340
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access Moderate
CVE-2026-65593 was published for n8n (npm) Jul 22, 2026
al1z4deh Credited to al1z4deh
Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access Moderate
GHSA-38fj-36m5-783c was published for n8n (npm) Jul 22, 2026 • withdrawn
Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios Moderate
GHSA-f4gw-2p7v-4548 was published for axios (npm) Jul 20, 2026
jayant-eai Credited to jayant-eai
TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard Moderate
CVE-2026-54546 was published for @tak-ps/cloudtak (npm) Jul 17, 2026
tonghuaroot Credited to tonghuaroot
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060) Moderate
CVE-2026-53509 was published for @aborruso/ckan-mcp-server (npm) Jul 7, 2026
hibrian827 Credited to hibrian827
@asymmetric-effort/specifyjs: No redirect target validation in secureFetch Moderate
GHSA-j5qp-p44g-2m49 was published for @asymmetric-effort/specifyjs (npm) Jul 2, 2026
@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction Moderate
GHSA-2944-57xv-2682 was published for @asymmetric-effort/specifyjs (npm) Jul 2, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database