Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,183
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

604 advisories

Loading
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts... High Unreviewed
CVE-2026-109949 was published Oct 13, 2026
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to... Moderate Unreviewed
CVE-2026-18318 was published Oct 13, 2026
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken... Critical Unreviewed
CVE-2026-53997 was published Oct 12, 2026
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts... Moderate Unreviewed
CVE-2026-108580 was published Oct 10, 2026
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because... Moderate Unreviewed
CVE-2026-108163 was published Oct 10, 2026
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords Moderate
CVE-2026-91973 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited High
CVE-2026-91972 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password... Critical Unreviewed
CVE-2026-108109 was published Oct 9, 2026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... High Unreviewed
CVE-2026-76779 was published Oct 9, 2026
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of... High Unreviewed
CVE-2026-107638 was published Oct 8, 2026
Payload: Unauthenticated account-lockout denial of service Moderate
CVE-2026-105866 was published for payload (npm) Oct 7, 2026
nhattanhh Credited to nhattanhh
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access... Critical Unreviewed
CVE-2026-105835 was published Oct 6, 2026
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of... Low Unreviewed
CVE-2026-105237 was published Oct 5, 2026
The WebSocket Application Programming Interface lacks restrictions on the number of... High Unreviewed
CVE-2026-97363 was published Oct 3, 2026
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path Low
CVE-2026-102825 was published for russh (Rust) Sep 30, 2026
arpitjain099 Credited to arpitjain099
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing... Critical Unreviewed
CVE-2026-102334 was published Sep 29, 2026
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges,... High Unreviewed
CVE-2026-100678 was published Sep 26, 2026
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts... High Unreviewed
CVE-2026-100501 was published Sep 26, 2026
Improper Restriction of Excessive Authentication Attempts in the administration login of... Moderate Unreviewed
CVE-2026-37603 was published Sep 22, 2026
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks Critical
CVE-2026-85734 was published for lightrag-hku (pip) Sep 22, 2026
MaramHarsha Credited to MaramHarsha
Tinyauth: Unauthenticated login attempts can trigger global login lockdown denial of service Moderate
CVE-2026-77561 was published for github.com/steveiliop56/tinyauth (Go) Sep 22, 2026
sondt99 Credited to sondt99
9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header Moderate
CVE-2026-56682 was published for 9router (npm) Sep 22, 2026
b401t Credited to b401t
@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register` Moderate
CVE-2026-58271 was published for @sync-in/server (npm) Sep 22, 2026
SakusenSec Credited to SakusenSec and johaven johaven johaven
A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This... Low Unreviewed
CVE-2026-93650 was published Sep 18, 2026
An improper restriction of excessive authentication attempts vulnerability in Auto block in... Low Unreviewed
CVE-2026-40538 was published Sep 18, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database