Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

6,578 advisories

Loading
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers Moderate
CVE-2026-77606 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes High
CVE-2025-61682 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
SomeMWDev Credited to SomeMWDev
Grav CMS vulnerable to remote code execution via .zip file upload High
CVE-2026-72819 was published for getgrav/grav (Composer) Sep 17, 2026
Kuba0123 Credited to Kuba0123
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin High
CVE-2026-75837 was published for getgrav/grav (Composer) Sep 17, 2026
manus-use Credited to manus-use
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate Moderate
CVE-2026-75834 was published for getgrav/grav (Composer) Sep 17, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write Critical
CVE-2026-75827 was published for getgrav/grav (Composer) Sep 17, 2026
arpitjain099 Credited to arpitjain099
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS Critical
CVE-2026-75828 was published for getgrav/grav (Composer) Sep 17, 2026
arpitjain099 Credited to arpitjain099
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) High
CVE-2026-74907 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion High
CVE-2026-72695 was published for getgrav/grav (Composer) Sep 17, 2026
ka3n1x Credited to ka3n1x
react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU High
CVE-2026-84997 was published for react/http (Composer) Sep 17, 2026
jsifuentes Credited to jsifuentes
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection Critical
CVE-2026-79752 was published for cakephp/cakephp (Composer) Sep 17, 2026
unknownhad Credited to unknownhad and mfn mfn mfn
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content High
CVE-2026-72697 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet() High
CVE-2026-76839 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled High
CVE-2026-76846 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths High
CVE-2026-72698 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection Low
CVE-2026-72701 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match Low
CVE-2026-72702 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution Critical
CVE-2026-45140 was published for chamilo/chamilo-lms (Composer) Sep 17, 2026
h4knet Credited to h4knet
Grav: Stored XSS via Markdown audio/video media <source> URL Moderate
CVE-2026-75831 was published for getgrav/grav (Composer) Sep 17, 2026
alimony Credited to alimony
Grav: Stored XSS via quoted-attribute bypass in detectXss Moderate
CVE-2026-72832 was published for getgrav/grav (Composer) Sep 17, 2026
koyokr Credited to koyokr
Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images High
CVE-2026-69089 was published for getgrav/grav (Composer) Sep 17, 2026
nihaddhuseynli Credited to nihaddhuseynli
Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure High
CVE-2026-69088 was published for getgrav/grav (Composer) Sep 17, 2026
adamyordan Credited to adamyordan
Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation High
CVE-2026-65608 was published for getgrav/grav (Composer) Sep 17, 2026
haftoe Credited to haftoe
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer Moderate
CVE-2026-61449 was published for getgrav/grav (Composer) Sep 17, 2026
iliaal Credited to iliaal
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav Moderate
CVE-2026-58657 was published for getgrav/grav (Composer) Sep 16, 2026
DavidCarliez Credited to DavidCarliez
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database