Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

9 advisories

Loading
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation Critical
CVE-2026-10561 was published for langflow (pip) Oct 6, 2026
XlabAITeam Credited to XlabAITeam, pkuGenuine, keenanwgn, andifilhohub, and erichare pkuGenuine pkuGenuine
keenanwgn keenanwgn andifilhohub andifilhohub erichare erichare
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package Critical
CVE-2026-92951 was published for vm2 (npm) Oct 1, 2026
XlabAITeam Credited to XlabAITeam, keenanwgn, pkuGenuine, and liangjs keenanwgn keenanwgn
pkuGenuine pkuGenuine liangjs liangjs
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions High
CVE-2026-102676 was published for electron (npm) Sep 29, 2026
XlabAITeam Credited to XlabAITeam, keenanwgn, pkuGenuine, and liangjs keenanwgn keenanwgn
pkuGenuine pkuGenuine liangjs liangjs
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing Critical
CVE-2026-61539 was published for xinference (pip) Aug 21, 2026
XlabAITeam Credited to XlabAITeam, keenanwgn, pkuGenuine, and A7um keenanwgn keenanwgn
pkuGenuine pkuGenuine A7um A7um
MindsDB: Path Traversal in /api/files Leading to Remote Code Execution High
CVE-2026-27483 was published for mindsdb (pip) Feb 24, 2026
XlabAITeam Credited to XlabAITeam, keenanwgn, and pkuGenuine keenanwgn keenanwgn
pkuGenuine pkuGenuine
Alist vulnerable to Path Traversal in multiple file operation handlers High
CVE-2026-25161 was published for github.com/alist-org/alist/v3 (Go) Feb 4, 2026
XlabAITeam Credited to XlabAITeam, pkuGenuine, A7um, keenanwgn, and okatu-loli pkuGenuine pkuGenuine
A7um A7um keenanwgn keenanwgn okatu-loli okatu-loli
Alist has Insecure TLS Config Critical
CVE-2026-25160 was published for github.com/alist-org/alist/v3 (Go) Feb 4, 2026
XlabAITeam Credited to XlabAITeam, pkuGenuine, A7um, keenanwgn, and okatu-loli pkuGenuine pkuGenuine
A7um A7um keenanwgn keenanwgn okatu-loli okatu-loli
OpenList has Insecure TLS Default Configuration High
CVE-2026-25060 was published for github.com/OpenListTeam/OpenList/v4 (Go) Feb 2, 2026
XlabAITeam Credited to XlabAITeam, dezhishen, KirCute, jyxjjj, A7um, pkuGenuine, and keenanwgn dezhishen dezhishen
KirCute KirCute jyxjjj jyxjjj A7um A7um pkuGenuine pkuGenuine keenanwgn keenanwgn
OpenList vulnerable to Path Traversal in file copy and remove handlers High
CVE-2026-25059 was published for github.com/OpenListTeam/OpenList/v4 (Go) Feb 2, 2026
XlabAITeam Credited to XlabAITeam, KirCute, dezhishen, Suyunmeng, jyxjjj, A7um, pkuGenuine, and keenanwgn KirCute KirCute
dezhishen dezhishen Suyunmeng Suyunmeng jyxjjj jyxjjj A7um A7um pkuGenuine pkuGenuine keenanwgn keenanwgn
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database