Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

6,578 advisories

Loading
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation Moderate
CVE-2026-61453 was published for getgrav/grav (Composer) Sep 16, 2026
alienkeric Credited to alienkeric and gemstone-source gemstone-source gemstone-source
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() Moderate
CVE-2026-59193 was published for getgrav/grav (Composer) Sep 16, 2026
Scriptmagum Credited to Scriptmagum
October CMS: Incomplete Scheme Validation in Image Resizer Low
GHSA-2xmm-m4wv-3fjh was published for october/october (Composer) Sep 14, 2026
0xGenesi Credited to 0xGenesi
October CMS: PHP Object Injection via Backend Widget Session Storage Low
CVE-2026-49400 was published for october/system (Composer) Sep 14, 2026
EndlssNightmare Credited to EndlssNightmare
October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls Low
CVE-2026-46696 was published for october/system (Composer) Sep 14, 2026
r00tn0b0dy Credited to r00tn0b0dy
Shopper: Missing authorization on product removal actions in CollectionProducts component High
CVE-2026-56825 was published for shopper/framework (Composer) Sep 11, 2026
therawdev Credited to therawdev
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph) Moderate
CVE-2026-56830 was published for shopper/framework (Composer) Sep 11, 2026
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component High
CVE-2026-56829 was published for shopper/framework (Composer) Sep 11, 2026
therawdev Credited to therawdev
Shopper: privilege escalation via improper Livewire admin component authorization High
CVE-2026-56828 was published for shopper/framework (Composer) Sep 11, 2026
therawdev Credited to therawdev
Shopping privilege escalation through missing authorization in Settings components Moderate
CVE-2026-56826 was published for shopper/framework (Composer) Sep 11, 2026
baradika Credited to baradika
Shopper: Negative discount values accepted and propagated through order calculation pipeline Moderate
CVE-2026-56831 was published for shopper/framework (Composer) Sep 11, 2026
Fr6ey Credited to Fr6ey
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers High
CVE-2026-56827 was published for shopper/framework (Composer) Sep 11, 2026
therawdev Credited to therawdev
Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration High
CVE-2026-55416 was published for pimcore/pimcore (Composer) Sep 10, 2026
EclipsSec Credited to EclipsSec
Duplicate Advisory: GridFS data disclosure and deletion via query-operator injection in file IDs Moderate
GHSA-x6mc-fgjf-77r7 was published for mongodb/mongodb (Composer) Sep 10, 2026 • withdrawn
mongodb: Reject "." and NUL bytes in database and collection names High
CVE-2026-81525 was published for mongodb/mongodb (Composer) Sep 8, 2026
Composer arbitrary command execution via a malicious package's Perforce source URL High
CVE-2026-84361 was published for composer/composer (Composer) Sep 8, 2026
Saku0512 Credited to Saku0512
phpseclib — non-constant-time X25519 scalar multiplication permits full private-key recovery Moderate
CVE-2026-84308 was published for phpseclib/phpseclib (Composer) Sep 8, 2026
geostergiop Credited to geostergiop and hexblot hexblot hexblot
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections Critical
CVE-2026-84372 was published for predis/predis (Composer) Sep 8, 2026
s2x Credited to s2x
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver Critical
CVE-2026-77635 was published for cakephp/cakephp (Composer) Sep 8, 2026
CakePHP: SmtpTransport vulnerable to CRLF header injection High
CVE-2026-77634 was published for cakephp/cakephp (Composer) Sep 8, 2026
unknownhad Credited to unknownhad
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path High
CVE-2026-84374 was published for maatwebsite/excel (Composer) Sep 8, 2026
seck19 Credited to seck19
Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge High
CVE-2026-62669 was published for getgrav/grav (Composer) Sep 2, 2026
nicl4ssic Credited to nicl4ssic
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass) Moderate
CVE-2026-61842 was published for getgrav/grav (Composer) Sep 2, 2026
iliaal Credited to iliaal
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits Moderate
CVE-2026-61690 was published for getgrav/grav (Composer) Sep 2, 2026
alienkeric Credited to alienkeric
Sulu: Stored XSS via media download inline-disposition override Moderate
CVE-2026-82396 was published for sulu/sulu (Composer) Sep 2, 2026
0x3xP01t3r Credited to 0x3xP01t3r
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database