Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,897 advisories

Loading
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution High
CVE-2026-104890 was published for kunstmaan/bundles-cms (Composer) Oct 7, 2026
N0fl0w Credited to N0fl0w and acrobat acrobat acrobat
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan High
GHSA-3q6v-r5mr-hxv8 was published for league/commonmark (Composer) Sep 30, 2026
manus-pi Credited to manus-pi
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() High
CVE-2026-65954 was published for phpcsstandards/phpcsutils (Composer) Sep 29, 2026
rodrigoprimo Credited to rodrigoprimo, FORIMOC, edorian, and jrfnl FORIMOC FORIMOC
edorian edorian jrfnl jrfnl
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled High
CVE-2026-57440 was published for starcitizenwiki/embedvideo (Composer) Sep 25, 2026
andmcadams Credited to andmcadams
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute High
CVE-2026-61823 was published for code16/sharp (Composer) Sep 25, 2026
nova-aryan Credited to nova-aryan
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass High
CVE-2026-61825 was published for code16/sharp (Composer) Sep 25, 2026
nova-aryan Credited to nova-aryan
zbateson/mail-mime-parser has CRLF header injection via attachment filename High
CVE-2026-61815 was published for zbateson/mail-mime-parser (Composer) Sep 24, 2026
iliaal Credited to iliaal
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME High
CVE-2026-61816 was published for zbateson/mail-mime-parser (Composer) Sep 24, 2026
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion High
CVE-2026-56738 was published for phpmyfaq/phpmyfaq (Composer) Sep 24, 2026
DomainXTech Credited to DomainXTech
phpMyFAQ's two-factor authentication login bypasses the password factor High
CVE-2026-56737 was published for phpmyfaq/phpmyfaq (Composer) Sep 24, 2026
waseem-cve Credited to waseem-cve
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission High
CVE-2026-56736 was published for phpmyfaq/phpmyfaq (Composer) Sep 24, 2026
JosanGeorge Credited to JosanGeorge
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API High
CVE-2026-63498 was published for snipe/snipe-it (Composer) Sep 24, 2026
B1gN0Se Credited to B1gN0Se, Rajib-Mahmud, and snipe Rajib-Mahmud Rajib-Mahmud
snipe snipe
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers High
CVE-2026-62368 was published for snipe/snipe-it (Composer) Sep 24, 2026
Mickey777777 Credited to Mickey777777
Snipe-IT: 2FA bypass via the API token flow High
CVE-2026-63493 was published for snipe/snipe-it (Composer) Sep 24, 2026
colinthebomb1 Credited to colinthebomb1
Formie: Missing authorization on sent notification resend modal exposes submission PII High
CVE-2026-76089 was published for verbb/formie (Composer) Sep 23, 2026
Pig-Tail Credited to Pig-Tail
Formie: Unauthenticated users can overwrite incomplete submissions via submit action High
CVE-2026-76087 was published for verbb/formie (Composer) Sep 23, 2026
Pig-Tail Credited to Pig-Tail
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials High
CVE-2026-76086 was published for verbb/formie (Composer) Sep 23, 2026
Pig-Tail Credited to Pig-Tail
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks High
GHSA-jr78-w6w5-m8f8 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes High
CVE-2025-61682 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
SomeMWDev Credited to SomeMWDev
Grav CMS vulnerable to remote code execution via .zip file upload High
CVE-2026-72819 was published for getgrav/grav (Composer) Sep 17, 2026
Kuba0123 Credited to Kuba0123
Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin High
CVE-2026-75837 was published for getgrav/grav (Composer) Sep 17, 2026
manus-use Credited to manus-use
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`) High
CVE-2026-74907 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion High
CVE-2026-72695 was published for getgrav/grav (Composer) Sep 17, 2026
ka3n1x Credited to ka3n1x
react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU High
CVE-2026-84997 was published for react/http (Composer) Sep 17, 2026
jsifuentes Credited to jsifuentes
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content High
CVE-2026-72697 was published for getgrav/grav (Composer) Sep 17, 2026
alham-rizvi Credited to alham-rizvi
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database