Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,501 advisories

Loading
There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak... Moderate Unreviewed
CVE-2026-104617 was published Oct 15, 2026
Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me... Critical Unreviewed
CVE-2026-63160 was published Oct 13, 2026
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where... Moderate Unreviewed
CVE-2026-109953 was published Oct 13, 2026
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability... High Unreviewed
CVE-2026-108904 was published Oct 11, 2026
Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected... Critical Unreviewed
CVE-2026-78835 was published Oct 9, 2026
Vikunja: TOTP secret is readable after enrollment, no step-up auth Moderate
CVE-2026-91982 was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien
Usernames and passwords, including the default factory credentials, are stored in plaintext... Critical Unreviewed
CVE-2026-39460 was published Oct 9, 2026
Mechanize sends credential headers to another origin after a meta refresh Moderate
CVE-2026-107399 was published for mechanize (RubyGems) Oct 8, 2026
flavorjones Credited to flavorjones
Mechanize sends credential headers to another host after an HTTP redirect Moderate
CVE-2026-107715 was published for mechanize (RubyGems) Oct 8, 2026
SnailSploit Credited to SnailSploit
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel Moderate
CVE-2026-107285 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host Critical
CVE-2026-107282 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext High
CVE-2026-107231 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in... High Unreviewed
CVE-2026-105833 was published Oct 8, 2026
In Brocade ASCG before 3.5.0, a  local unauthorized user on the ASCG VM who can issue a request... High Unreviewed
CVE-2026-87428 was published Oct 8, 2026
Docling: Configured HTTP headers sent to every remote image host named by a document Low
CVE-2026-105742 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff
As part of Cisco's ongoing commitment to proactive security and product quality, the engineering... Critical Unreviewed
CVE-2026-76483 was published Oct 7, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain... High Unreviewed
CVE-2026-101331 was published Oct 7, 2026
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server High
CVE-2026-104850 was published for @modelcontextprotocol/client (npm) Oct 6, 2026
Aviral2642 Credited to Aviral2642, AlexMelanFromRingo, Gal3m, JosephDoUrden, Igfray, OriginalKazdov, and lwebmedia AlexMelanFromRingo AlexMelanFromRingo
Gal3m Gal3m JosephDoUrden JosephDoUrden Igfray Igfray OriginalKazdov OriginalKazdov lwebmedia lwebmedia
Charging station authentication identifiers are publicly accessible via web-based mapping platforms. Moderate Unreviewed
CVE-2026-93474 was published Oct 3, 2026
PictShare before 3.7.1 contains an information disclosure vulnerability that allows... High Unreviewed
CVE-2026-104051 was published Oct 2, 2026
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in... High Unreviewed
CVE-2026-103256 was published Oct 1, 2026
The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to... Moderate Unreviewed
CVE-2026-92537 was published Oct 1, 2026
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by... Low Unreviewed
CVE-2026-100264 was published Sep 30, 2026
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal... High Unreviewed
CVE-2026-100298 was published Sep 29, 2026
Apache Airflow's Snowflake provider did not validate the connection's `account` and `region`... Moderate Unreviewed
CVE-2026-81930 was published Sep 29, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database