Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,183
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

2,177 advisories

Loading
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check Moderate
GHSA-fmmf-xq98-g327 was published for code.vikunja.io/api (Go) Oct 9, 2026
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) Moderate
GHSA-pjr3-86v4-5p7w was published for code.vikunja.io/api (Go) Oct 9, 2026
Viv3kGupt4 Credited to Viv3kGupt4
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed Moderate
GHSA-hjx8-qv73-f7cm was published for code.vikunja.io/api (Go) Oct 9, 2026
euriconicacio Credited to euriconicacio and Tan-JunWei Tan-JunWei Tan-JunWei
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants Moderate
GHSA-fprf-r6rv-xg99 was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes Moderate
GHSA-4hv6-xc92-j86g was published for code.vikunja.io/api (Go) Oct 9, 2026
Tan-JunWei Credited to Tan-JunWei
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout Moderate
CVE-2026-107804 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
lujiefsi Credited to lujiefsi
Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint Moderate
GHSA-8wvg-r2j4-3737 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: Cross-project task disclosure through subtask expansion Moderate
GHSA-3hc7-r24j-rpwc was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien and JellowBeanz26 JellowBeanz26 JellowBeanz26
Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID Moderate
GHSA-g38j-7v97-x298 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: Link-share token can enumerate users through the v2 API Moderate
CVE-2026-91981 was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien
Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API Moderate
GHSA-vcgv-7rvm-m3vp was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project Moderate
CVE-2026-91980 was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien
Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project Moderate
GHSA-2922-qgfj-pr7v was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords Moderate
CVE-2026-91973 was published for code.vikunja.io/api (Go) Oct 9, 2026
JellowBeanz26 Credited to JellowBeanz26
Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) Moderate
CVE-2026-91983 was published for code.vikunja.io/api (Go) Oct 9, 2026
Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) Moderate
GHSA-phph-c358-5mwm was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) Moderate
CVE-2026-91984 was published for code.vikunja.io/api (Go) Oct 9, 2026
ybsun0215 Credited to ybsun0215 and JellowBeanz26 JellowBeanz26 JellowBeanz26
Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) Moderate
GHSA-ccgq-fx7h-2v4c was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Vikunja: TOTP secret is readable after enrollment, no step-up auth Moderate
CVE-2026-91982 was published for code.vikunja.io/api (Go) Oct 9, 2026
0xcelien Credited to 0xcelien
Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth Moderate
GHSA-jmr8-r558-3jhx was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor Moderate
CVE-2026-107834 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
oguzylmzx Credited to oguzylmzx
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion Moderate
CVE-2026-107833 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
oguzylmzx Credited to oguzylmzx
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations Moderate
CVE-2026-107825 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB Moderate
CVE-2026-107386 was published for github.com/rabbitmq/amqp091-go (Go) Oct 8, 2026
timobrie Credited to timobrie and Zerpet Zerpet Zerpet
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection Moderate
GHSA-w253-m66g-rx24 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
MushroomWasp Credited to MushroomWasp
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database