Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

194 advisories

Loading
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts... High Unreviewed
CVE-2026-109949 was published Oct 13, 2026
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited High
CVE-2026-91972 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... High Unreviewed
CVE-2026-76779 was published Oct 9, 2026
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of... High Unreviewed
CVE-2026-107638 was published Oct 8, 2026
The WebSocket Application Programming Interface lacks restrictions on the number of... High Unreviewed
CVE-2026-97363 was published Oct 3, 2026
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges,... High Unreviewed
CVE-2026-100678 was published Sep 26, 2026
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts... High Unreviewed
CVE-2026-100501 was published Sep 26, 2026
Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited High
GHSA-m4vj-wr5q-cmvr was published for github.com/go-vikunja/vikunja (Go) Sep 15, 2026 • withdrawn
Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords High
GHSA-p2vv-wrh8-x466 was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute... High Unreviewed
CVE-2026-89174 was published Sep 11, 2026
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... High Unreviewed
CVE-2026-78490 was published Sep 9, 2026
A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an... High Unreviewed
CVE-2026-85237 was published Sep 3, 2026
A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security... High Unreviewed
CVE-2026-16675 was published Sep 1, 2026
WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in... High Unreviewed
CVE-2026-82644 was published Aug 30, 2026
The affected Ebyte device does not restrict repeated authentication attempts through rate... High Unreviewed
CVE-2026-76940 was published Aug 28, 2026
RansomLook contains multiple weaknesses in its authentication endpoint that allow an... High Unreviewed
CVE-2026-78551 was published Aug 24, 2026
SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish... High Unreviewed
CVE-2026-74868 was published Aug 17, 2026
SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts... High Unreviewed
CVE-2026-73045 was published Aug 16, 2026
UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT... High Unreviewed
CVE-2026-65948 was published Aug 10, 2026
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second... High Unreviewed
CVE-2026-16619 was published Aug 7, 2026
MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective... High Unreviewed
CVE-2026-16347 was published Jul 28, 2026
This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP... High Unreviewed
CVE-2026-65894 was published Jul 27, 2026
A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout... High Unreviewed
CVE-2026-14254 was published Jul 16, 2026
PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access... High Unreviewed
CVE-2026-61458 was published Jul 14, 2026
Previously, there was no throttling on repeated authentication attempts to the charging station... High Unreviewed
CVE-2026-42952 was published Jul 11, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database