Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

606 advisories

Loading
Yamcs has No Rate Limiting on Authentication Endpoint Moderate
CVE-2026-44596 was published for org.yamcs:yamcs-core (Maven) May 27, 2026
ex-cal1bur Credited to ex-cal1bur
Improper restriction of excessive authentication attempts vulnerability in Turkiye Electricity... Moderate Unreviewed
CVE-2026-1816 was published May 21, 2026
phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration High
CVE-2026-35675 was published for phpmyfaq/phpmyfaq (Composer) May 20, 2026
cyberHunter127 Credited to cyberHunter127
In BYD Atto3, an attacker can obtain an authentication key through Brute Force attack, which is... High Unreviewed
CVE-2025-61081 was published May 19, 2026
iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that... Critical Unreviewed
CVE-2020-37228 was published May 16, 2026
Duplicate Advisory: phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id Critical
GHSA-6626-79jh-5ccr was published for phpmyfaq/phpmyfaq (Composer) May 15, 2026 • withdrawn
Better Auth: Rate limiter keys IPv6 addresses individually and is bypassable via prefix rotation High
CVE-2026-45364 was published for better-auth (npm) May 15, 2026
nexryai Credited to nexryai
HCL AION is affected by a vulnerability where adequate protections against brute-force attempts... Moderate Unreviewed
CVE-2025-62313 was published May 14, 2026
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying Moderate
CVE-2025-64526 was published for @strapi/plugin-users-permissions (npm) May 13, 2026
adriatikii Credited to adriatikii and derrickmehaffy derrickmehaffy derrickmehaffy
** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts... Moderate Unreviewed
CVE-2026-7255 was published May 12, 2026
pgAdmin 4: Improper restriction of excessive authentication attempts Moderate
CVE-2026-7820 was published for pgadmin4 (pip) May 11, 2026
Improper restriction of excessive authentication attempts vulnerability in Hitachi Virtual... Moderate Unreviewed
CVE-2025-2514 was published May 7, 2026
phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id Critical
CVE-2026-45010 was published for phpmyfaq/phpmyfaq (Composer) May 6, 2026
adrgs Credited to adrgs and aisafe-bot aisafe-bot aisafe-bot
OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to... High Unreviewed
CVE-2023-54347 was published May 5, 2026
Signal K Server's WebSocket Login Endpoint Lacks Rate Limiting (Credential Brute-Force) High
CVE-2026-41893 was published for signalk-server (npm) May 4, 2026
A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The... Low Unreviewed
CVE-2026-7671 was published May 3, 2026
U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the... High Unreviewed
CVE-2026-36959 was published Apr 30, 2026
The RTSP service of MERCURY IP camera MIPC252W 1.0.5 Build 230306 has an issue handling failed... Moderate Unreviewed
CVE-2026-35902 was published Apr 27, 2026
DWM-222W USB Wi-Fi Adapter developed by D-Link has a Brute-Force Protection Bypass vulnerability,... High Unreviewed
CVE-2026-6947 was published Apr 24, 2026
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if... High Unreviewed
CVE-2026-0972 was published Apr 21, 2026
The login limit is not enforced on the SFTP service of Fortra's GoAnywhere MFT prior to 7.10.0 if... High Unreviewed
CVE-2025-14362 was published Apr 21, 2026
This vulnerability exists in Quantum Networks router due to missing rate limiting and CAPTCHA... High Unreviewed
CVE-2026-41037 was published Apr 21, 2026
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release... Moderate Unreviewed
CVE-2025-46606 was published Apr 17, 2026
@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes Moderate
CVE-2026-41213 was published for @node-oauth/oauth2-server (npm) Apr 16, 2026
KarimTantawey Credited to KarimTantawey, jankapunkt, and dhensby jankapunkt jankapunkt
dhensby dhensby
Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against... Moderate Unreviewed
CVE-2026-22616 was published Apr 16, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database