Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

607 advisories

Loading
Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.7, and @better... Moderate Unreviewed
CVE-2026-110861 was published Oct 15, 2026
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows... Critical Unreviewed
CVE-2026-110770 was published Oct 14, 2026
An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows... Low Unreviewed
CVE-2026-93637 was published Oct 14, 2026
FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts... High Unreviewed
CVE-2026-109949 was published Oct 13, 2026
VideoLAN VLC for Android prior to version 3.7.0 contain an authentication bypass in the Remote... Moderate Unreviewed
CVE-2026-26227 was published Feb 26, 2026
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to... Moderate Unreviewed
CVE-2026-18318 was published Oct 13, 2026
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken... Critical Unreviewed
CVE-2026-53997 was published Oct 12, 2026
AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts... Moderate Unreviewed
CVE-2026-108580 was published Oct 10, 2026
Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because... Moderate Unreviewed
CVE-2026-108163 was published Oct 10, 2026
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords Moderate
CVE-2026-91973 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords High
GHSA-p2vv-wrh8-x466 was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited High
CVE-2026-91972 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited High
GHSA-m4vj-wr5q-cmvr was published for github.com/go-vikunja/vikunja (Go) Sep 15, 2026 • withdrawn
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password... Critical Unreviewed
CVE-2026-108109 was published Oct 9, 2026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an... High Unreviewed
CVE-2026-76779 was published Oct 9, 2026
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of... High Unreviewed
CVE-2026-107638 was published Oct 8, 2026
Payload: Unauthenticated account-lockout denial of service Moderate
CVE-2026-105866 was published for payload (npm) Oct 7, 2026
nhattanhh Credited to nhattanhh
PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access... Critical Unreviewed
CVE-2026-105835 was published Oct 6, 2026
A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of... Low Unreviewed
CVE-2026-105237 was published Oct 5, 2026
The WebSocket Application Programming Interface lacks restrictions on the number of... High Unreviewed
CVE-2026-97363 was published Oct 3, 2026
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path Low
CVE-2026-102825 was published for russh (Rust) Sep 30, 2026
arpitjain099 Credited to arpitjain099
Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing... Critical Unreviewed
CVE-2026-102334 was published Sep 29, 2026
stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges,... High Unreviewed
CVE-2026-100678 was published Sep 26, 2026
Flame through 2.4.0 contains an improper restriction of excessive authentication attempts... High Unreviewed
CVE-2026-100501 was published Sep 26, 2026
Improper Restriction of Excessive Authentication Attempts in the administration login of... Moderate Unreviewed
CVE-2026-37603 was published Sep 22, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database