Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,897 advisories

Loading
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template High
CVE-2026-55691 was published for starcitizenwiki/embedvideo (Composer) Jun 19, 2026
andmcadams Credited to andmcadams
StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled High
CVE-2026-55692 was published for starcitizenwiki/embedvideo (Composer) Jun 19, 2026
andmcadams Credited to andmcadams
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled High
CVE-2026-57440 was published for starcitizenwiki/embedvideo (Composer) Sep 25, 2026
andmcadams Credited to andmcadams
StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text High
CVE-2026-55690 was published for starcitizenwiki/embedvideo (Composer) Jun 19, 2026
andmcadams Credited to andmcadams
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution High
CVE-2026-104890 was published for kunstmaan/bundles-cms (Composer) Oct 7, 2026
N0fl0w Credited to N0fl0w and acrobat acrobat acrobat
Tiptap contains an input validation vulnerability resulting in DoS High
CVE-2026-47110 was published for ueberdosis/tiptap-php (Composer) Jun 25, 2026
Withdrawn Advisory: cart2quote/module-quotation-encoded Remote Code Execution via downloadCustomOptionAction High
GHSA-pgj4-g5j4-cmfx was published for cart2quote/module-quotation (Composer) May 15, 2024 • withdrawn
sBatao Credited to sBatao
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken() High
CVE-2026-32267 was published for craftcms/cms (Composer) Mar 16, 2026
carlini Credited to carlini
PHP_CodeSniffer gitblame report command injection via crafted filename High
CVE-2026-67434 was published for squizlabs/php_codesniffer (Composer) Aug 6, 2026
Faze-up Credited to Faze-up, edorian, rodrigoprimo, fredden, and jrfnl edorian edorian
rodrigoprimo rodrigoprimo fredden fredden jrfnl jrfnl
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan High
GHSA-3q6v-r5mr-hxv8 was published for league/commonmark (Composer) Sep 30, 2026
manus-pi Credited to manus-pi
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() High
CVE-2026-65954 was published for phpcsstandards/phpcsutils (Composer) Sep 29, 2026
rodrigoprimo Credited to rodrigoprimo, FORIMOC, edorian, and jrfnl FORIMOC FORIMOC
edorian edorian jrfnl jrfnl
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute High
CVE-2026-61823 was published for code16/sharp (Composer) Sep 25, 2026
nova-aryan Credited to nova-aryan
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass High
CVE-2026-61825 was published for code16/sharp (Composer) Sep 25, 2026
nova-aryan Credited to nova-aryan
zbateson/mail-mime-parser has CRLF header injection via attachment filename High
CVE-2026-61815 was published for zbateson/mail-mime-parser (Composer) Sep 24, 2026
iliaal Credited to iliaal
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME High
CVE-2026-61816 was published for zbateson/mail-mime-parser (Composer) Sep 24, 2026
phpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion High
CVE-2026-56738 was published for phpmyfaq/phpmyfaq (Composer) Sep 24, 2026
DomainXTech Credited to DomainXTech
phpMyFAQ's two-factor authentication login bypasses the password factor High
CVE-2026-56737 was published for phpmyfaq/phpmyfaq (Composer) Sep 24, 2026
waseem-cve Credited to waseem-cve
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission High
CVE-2026-56736 was published for phpmyfaq/phpmyfaq (Composer) Sep 24, 2026
JosanGeorge Credited to JosanGeorge
snipe-IT vulnerable to host header injection High
CVE-2022-23064 was published for snipe/snipe-it (Composer) May 3, 2022
zyl71 Credited to zyl71 and nikpivkin nikpivkin nikpivkin
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API High
CVE-2026-63498 was published for snipe/snipe-it (Composer) Sep 24, 2026
B1gN0Se Credited to B1gN0Se, Rajib-Mahmud, and snipe Rajib-Mahmud Rajib-Mahmud
snipe snipe
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers High
CVE-2026-62368 was published for snipe/snipe-it (Composer) Sep 24, 2026
Mickey777777 Credited to Mickey777777
Snipe-IT: 2FA bypass via the API token flow High
CVE-2026-63493 was published for snipe/snipe-it (Composer) Sep 24, 2026
colinthebomb1 Credited to colinthebomb1
Duplicate Advisory: Grav is Vulnerable to XXE via SVG Upload High
GHSA-32fw-h446-j4hh was published for getgrav/grav (Composer) Jun 23, 2026 • withdrawn
Formie: Missing authorization on sent notification resend modal exposes submission PII High
CVE-2026-76089 was published for verbb/formie (Composer) Sep 23, 2026
Pig-Tail Credited to Pig-Tail
Formie: Unauthenticated users can overwrite incomplete submissions via submit action High
CVE-2026-76087 was published for verbb/formie (Composer) Sep 23, 2026
Pig-Tail Credited to Pig-Tail
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database