Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,183
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

4,970 advisories

Loading
gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled Critical
CVE-2026-73802 was published for gitea.com/gitea/runner (Go) Oct 2, 2026
sn0x-sharma Credited to sn0x-sharma
chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes Moderate
CVE-2025-71405 was published for github.com/go-chi/chi/v5 (Go) Jun 20, 2025
anuraagbaishya Credited to anuraagbaishya
Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes Moderate
GHSA-xcvf-46f4-xwxf was published for github.com/go-chi/chi (Go) Aug 14, 2026 • withdrawn
SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF) High
GHSA-x8gv-g2g3-65fj was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 2, 2026
joysinleung Credited to joysinleung
SiYuan MCP asset.upload Reads Arbitrary Absolute File Paths (Workspace Boundary Bypass) Moderate
GHSA-p23f-cm6q-2qp8 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 2, 2026
joysinleung Credited to joysinleung
SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers High
CVE-2026-74904 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 2, 2026
alham-rizvi Credited to alham-rizvi
Duplicate Advisory: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers High
GHSA-69jp-f2p8-9vrg was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 18, 2026 • withdrawn
SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass Low
CVE-2026-74802 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 2, 2026
alham-rizvi Credited to alham-rizvi
Duplicate Advisory: SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (`/ws/network/proxy`) via explicit `CheckOrigin: true` bypass Low
GHSA-x8p6-569w-fmmr was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 17, 2026 • withdrawn
GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute High
CVE-2026-30405 was published for github.com/osrg/gobgp/v4 (Go) Mar 16, 2026
tristanmorgan Credited to tristanmorgan
Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks High
GHSA-5wf9-h793-w73c was published for github.com/xtls/xray-core (Go) Oct 2, 2026
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs Critical
CVE-2026-59707 was published for github.com/mudler/LocalAI (Go) Jul 7, 2026
Nightingale exposes datasource credentials to low-privilege users High
CVE-2026-58167 was published for github.com/ccfos/nightingale/v6 (Go) Jun 30, 2026
Anubis: Policy bypass via client controlled X-Original-URI header Moderate
CVE-2026-62314 was published for github.com/TecharoHQ/anubis (Go) Oct 2, 2026
Zerotistic Credited to Zerotistic
Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route Critical
GHSA-75xh-mp4f-f2rf was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block Moderate
CVE-2026-73606 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 1, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block Moderate
GHSA-gq43-vcrh-6jw8 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route High
GHSA-9cqf-hhrq-7v45 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 1, 2026
Shirshakhtml Credited to Shirshakhtml
SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering Moderate
CVE-2026-73609 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 1, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering Moderate
GHSA-7v6h-j59w-8qfp was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem Moderate
CVE-2026-73605 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 1, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem Moderate
GHSA-xxm9-w59q-m66x was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check Moderate
CVE-2026-73607 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 1, 2026
Shirshakhtml Credited to Shirshakhtml
Duplicate Advisory: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check Moderate
GHSA-v372-phq5-6mx6 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking Critical
CVE-2026-69085 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 1, 2026
Shirshakhtml Credited to Shirshakhtml
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database