Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

416 advisories

Loading
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source Low
CVE-2026-107283 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError Low
CVE-2026-106449 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
Jenkins Active Directory Plugin has an LDAP injection vulnerability Low
CVE-2026-57288 was published for org.jenkins-ci.plugins:active-directory (Maven) Jun 24, 2026
AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses Low
CVE-2026-85716 was published for org.asynchttpclient:async-http-client (Maven) Sep 17, 2026
hyperxpro Credited to hyperxpro
Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root Low
CVE-2026-86071 was published for com.github.junrar:junrar (Maven) Sep 17, 2026
smaeljaish771 Credited to smaeljaish771 and KeenSecurityLab KeenSecurityLab KeenSecurityLab
MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests Low
CVE-2026-61700 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Sep 17, 2026
tharavel Credited to tharavel
Apache NiFi allows read-only users to submit component configuration verification request Low
CVE-2026-44911 was published for org.apache.nifi:nifi-web-api (Maven) Jun 22, 2026
Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties Low
CVE-2026-46584 was published for org.apache.camel:camel-mail (Maven) Jul 6, 2026
oscerd Credited to oscerd
Spring Web Services: WSS4J validation does not use configured replay cache Low
CVE-2026-41000 was published for org.springframework.ws:spring-ws-security (Maven) Jun 11, 2026
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max Low
CVE-2026-61634 was published for com.rabbitmq:amqp-client (Maven) Aug 18, 2026
Alexender676 Credited to Alexender676
Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads Low
CVE-2026-41694 was published for org.springframework.security:spring-security-saml2-service-provider (Maven) Jun 10, 2026
Spring Framework Denial of Service via AntPathMatcher Low
CVE-2026-41848 was published for org.springframework:spring-core (Maven) Jun 9, 2026
Spring Framework Arbitrary Method Invocation in SpEL Expressions Low
CVE-2026-41852 was published for org.springframework:spring-expression (Maven) Jun 9, 2026
hsweb-framework has a Path Traversal issue Low
CVE-2026-11470 was published for org.hswebframework.web:hsweb-system-file (Maven) Jun 8, 2026
hsweb-framework has an open redirect issue Low
CVE-2026-11477 was published for org.hswebframework.web:hsweb-authorization-oauth2 (Maven) Jun 8, 2026
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion Low
GHSA-464c-974j-9xm6 was published for @aws-cdk/aws-codebuild (Go) Jul 24, 2026
Keycloak: Information disclosure due to user profile permission bypass Low
CVE-2026-9088 was published for org.keycloak:keycloak-services (Maven) Jun 5, 2026
Logback vulnerable to Object Injection through HardenedObjectInputStream modules Low
CVE-2026-10532 was published for ch.qos.logback:logback-core (Maven) Jun 1, 2026
lgf10 Credited to lgf10
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation Low
CVE-2026-4874 was published for org.keycloak:keycloak-services (Maven) Mar 26, 2026
krapovneru Credited to krapovneru, dnegreira, and ahus1 dnegreira dnegreira
ahus1 ahus1
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim Low
CVE-2026-37977 was published for org.keycloak:keycloak-services (Maven) Apr 6, 2026
ahus1 Credited to ahus1
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login Low
CVE-2026-48589 was published for org.apache.shiro:shiro-jakarta-ee (Maven) May 26, 2026
yeikel Credited to yeikel
Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. Low
CVE-2026-22741 was published for org.springframework:spring-webflux (Maven) Apr 29, 2026
yuki-matsuhashi Credited to yuki-matsuhashi
QOS.CH Sarl logback logback-core has a deserialization of untrusted data vulnerability Low
CVE-2026-9828 was published for ch.qos.logback:logback-core (Maven) May 28, 2026
land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory Low
GHSA-j6hm-v3x2-qv6j was published for land.oras:oras-java-sdk (Maven) Jul 1, 2026
tonghuaroot Credited to tonghuaroot and jonesbusy jonesbusy jonesbusy
CrateDB's Blob HTTP handler bypasses authorization Low
CVE-2026-49989 was published for io.crate:crate (Maven) Jul 1, 2026
fab1ano Credited to fab1ano and matriv matriv matriv
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database