Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,183
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

2,177 advisories

Loading
Duplicate Advisory: chi Allows Host Header Injection which Leads to Open Redirect in RedirectSlashes Moderate
GHSA-xcvf-46f4-xwxf was published for github.com/go-chi/chi (Go) Aug 14, 2026 • withdrawn
Duplicate Advisory: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem Moderate
GHSA-xxm9-w59q-m66x was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
Duplicate Advisory: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering Moderate
GHSA-7v6h-j59w-8qfp was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
Duplicate Advisory: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block Moderate
GHSA-gq43-vcrh-6jw8 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
Duplicate Advisory: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check Moderate
GHSA-v372-phq5-6mx6 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 13, 2026 • withdrawn
Duplicate Advisory: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents Moderate
GHSA-h4w7-mgq4-wg6x was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode) Moderate
GHSA-mhcc-g592-267j was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Absolute filesystem path and OS username disclosure via resolveAssetPath Moderate
GHSA-72xp-24p9-7vpf was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents Moderate
GHSA-89hf-xcx5-r9r6 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) Moderate
GHSA-j26h-r8jx-887c was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: SiYuan discloses an administrator's open documents and search terms to anonymous readers Moderate
GHSA-hpmw-8pgp-x77j was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) Moderate
GHSA-fxmw-rv85-5hwh was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers Moderate
GHSA-cm9f-w4h4-7j85 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Tag labels from password-protected documents are returned to readers who have not entered the password Moderate
GHSA-f68g-4xv8-2g75 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers Moderate
GHSA-v3v5-7j3j-cc6f was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: getEncryptedNotebookStatus discloses names and live unlock state of all encrypted notebooks to anonymous readers Moderate
GHSA-rchc-g58m-88jm was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Duplicate Advisory: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo Moderate
GHSA-mxjf-vfmv-qfm6 was published for github.com/siyuan-note/siyuan/kernel (Go) Aug 12, 2026 • withdrawn
Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint Moderate
CVE-2026-48786 was published for github.com/fleetdm/fleet/v4 (Go) Aug 12, 2026
fuzzztf Credited to fuzzztf
go-git: Malicious reference names may modify files outside the reference storage Moderate
CVE-2026-71557 was published for github.com/go-git/go-git/v5 (Go) Aug 7, 2026
Saku0512 Credited to Saku0512
Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port Moderate
CVE-2026-54765 was published for github.com/traefik/traefik/v3 (Go) Aug 6, 2026
gooood4u Credited to gooood4u
Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef Moderate
CVE-2026-71325 was published for github.com/traefik/traefik (Go) Aug 6, 2026
ttzero25 Credited to ttzero25
Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false Moderate
CVE-2026-54764 was published for github.com/traefik/traefik (Go) Aug 6, 2026
Pig-Tail Credited to Pig-Tail
Traefik CRD IngressRouteTCP ServersTransport Cross-Provider Namespace Bypass Moderate
CVE-2026-65602 was published for github.com/traefik/traefik/v3 (Go) Aug 5, 2026
CuB3y0nd Credited to CuB3y0nd and james-yusuke james-yusuke james-yusuke
Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion Moderate
CVE-2026-65601 was published for Traefik (Go) Aug 5, 2026
CuB3y0nd Credited to CuB3y0nd
rclone: Local Encoding Path Traversal Moderate
CVE-2026-71313 was published for github.com/rclone/rclone (Go) Aug 5, 2026
cyberlanc3r Credited to cyberlanc3r and ncw ncw ncw
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database