Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,183
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

2,177 advisories

Loading
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check Moderate
GHSA-fmmf-xq98-g327 was published for code.vikunja.io/api (Go) Oct 9, 2026
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) Moderate
GHSA-pjr3-86v4-5p7w was published for code.vikunja.io/api (Go) Oct 9, 2026
Viv3kGupt4 Credited to Viv3kGupt4
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed Moderate
GHSA-hjx8-qv73-f7cm was published for code.vikunja.io/api (Go) Oct 9, 2026
euriconicacio Credited to euriconicacio and Tan-JunWei Tan-JunWei Tan-JunWei
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants Moderate
GHSA-fprf-r6rv-xg99 was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes Moderate
GHSA-4hv6-xc92-j86g was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout Moderate
CVE-2026-107804 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
lujiefsi Credited to lujiefsi
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint Moderate
GHSA-8wvg-r2j4-3737 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: Cross-project task disclosure through subtask expansion Moderate
GHSA-3hc7-r24j-rpwc was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien and JellowBeanz26 JellowBeanz26 JellowBeanz26
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID Moderate
GHSA-g38j-7v97-x298 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: Link-share token can enumerate users through the v2 API Moderate
CVE-2026-91981 was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project Moderate
CVE-2026-91980 was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords Moderate
CVE-2026-91973 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) Moderate
CVE-2026-91983 was published for code.vikunja.io/api (Go) Oct 9, 2026
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) Moderate
CVE-2026-91984 was published for code.vikunja.io/api (Go) Oct 9, 2026
ybsun0215 Credited to ybsun0215 and JellowBeanz26 JellowBeanz26 JellowBeanz26
Vikunja: TOTP secret is readable after enrollment, no step-up auth Moderate
CVE-2026-91982 was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB Moderate
CVE-2026-107386 was published for github.com/rabbitmq/amqp091-go (Go) Oct 8, 2026
timobrie Credited to timobrie and Zerpet Zerpet Zerpet
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor Moderate
CVE-2026-107834 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
oguzylmzx Credited to oguzylmzx
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection Moderate
GHSA-w253-m66g-rx24 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
MushroomWasp Credited to MushroomWasp
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion Moderate
CVE-2026-107833 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
oguzylmzx Credited to oguzylmzx
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules Moderate
GHSA-3wr7-993q-jrff was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
airween Credited to airween and janmrow janmrow janmrow
Coraza has Cookie Parser Confusion Moderate
GHSA-g4qm-m288-5cp9 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
HackingRepo Credited to HackingRepo and fzipi fzipi fzipi
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations Moderate
CVE-2026-107825 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
Coraza: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass Moderate
CVE-2026-104774 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
zuesdevil Credited to zuesdevil and M4tteoP M4tteoP M4tteoP
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection Moderate
GHSA-5gj4-9gm7-2fx2 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
MushroomWasp Credited to MushroomWasp
github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files Moderate
CVE-2026-61801 was published for github.com/moby/sys/user (Go) Oct 8, 2026
thaJeztah Credited to thaJeztah and kolyshkin kolyshkin kolyshkin
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database