Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

3,570 advisories

Loading
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled Moderate
CVE-2026-107842 was published for contao/core-bundle (Composer) Oct 9, 2026
iRevivalx Credited to iRevivalx
Contao: The registration module re-sends activation mails Moderate
CVE-2026-107843 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Path traversal in the images controller Moderate
CVE-2026-107844 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Improper access control in the preview links module Moderate
CVE-2026-107850 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Improper access control in the table access voter Moderate
CVE-2026-107851 was published for contao/core-bundle (Composer) Oct 9, 2026
sven-jaeger-git Credited to sven-jaeger-git
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision Moderate
CVE-2026-107380 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
ExPatch-LLC Credited to ExPatch-LLC
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences Moderate
CVE-2026-107381 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
arpitjain099 Credited to arpitjain099
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash Moderate
CVE-2026-107379 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
ExPatch-LLC Credited to ExPatch-LLC
Filament: Multi-factor authentication (app) management actions do not require password reauthentication Moderate
CVE-2026-104181 was published for filament/filament (Composer) Oct 5, 2026
Yezper Credited to Yezper and danharrin danharrin danharrin
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs Moderate
CVE-2026-88023 was published for mongodb/mongodb (Composer) Oct 5, 2026
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path Moderate
CVE-2026-59944 was published for composer/composer (Composer) Oct 2, 2026
DavidCarliez Credited to DavidCarliez, manus-use, and arpitjain099 manus-use manus-use
arpitjain099 arpitjain099
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal Moderate
GHSA-97jj-33gv-5xf9 was published for league/commonmark (Composer) Sep 30, 2026
4n86rakam1 Credited to 4n86rakam1
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration Moderate
CVE-2026-62998 was published for redaxo/source (Composer) Sep 24, 2026
de3erve-hunter Credited to de3erve-hunter
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) Moderate
CVE-2026-92692 was published for sulu/sulu (Composer) Sep 23, 2026
Solspace Freeform: Limited Twig template injection via submitted field values Moderate
CVE-2026-73858 was published for solspace/craft-freeform (Composer) Sep 23, 2026
wakedxy Credited to wakedxy
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost Moderate
CVE-2026-88974 was published for wp-graphql/wp-graphql (Composer) Sep 23, 2026
rajukani100 Credited to rajukani100
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates Moderate
CVE-2026-63000 was published for redaxo/source (Composer) Sep 23, 2026
de3erve-hunter Credited to de3erve-hunter
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames Moderate
CVE-2026-63002 was published for redaxo/source (Composer) Sep 23, 2026
de3erve-hunter Credited to de3erve-hunter
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` Moderate
CVE-2026-63001 was published for redaxo/source (Composer) Sep 23, 2026
de3erve Credited to de3erve
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) Moderate
CVE-2026-71537 was published for paymenter/paymenter (Composer) Sep 18, 2026
Pig-Tail Credited to Pig-Tail and CorwinDev CorwinDev CorwinDev
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) Moderate
GHSA-9rcc-pmj8-ffhr was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
arpitjain099 Credited to arpitjain099
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token Moderate
CVE-2026-77616 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) Moderate
CVE-2026-77610 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
Semantic MediaWiki has an open redirect in Special:URIResolver Moderate
CVE-2026-77609 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS Moderate
CVE-2026-77607 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database