Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,183
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

4,842 advisories

Loading
Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability Critical
CVE-2026-88092 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability Critical
CVE-2026-70188 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability Critical
CVE-2026-105016 was published for Microsoft.Native.Quic.MsQuic.Schannel (NuGet) Oct 13, 2026
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment Critical
CVE-2026-108261 was published for @tinacms/app (npm) Oct 9, 2026
sondt99 Credited to sondt99
Contao: Cross-site scripting in the comments bundle Critical
CVE-2026-107845 was published for contao/comments-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite Critical
CVE-2026-107806 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
mamdouhmahfouz Credited to mamdouhmahfouz
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) Critical
CVE-2026-68582 was published for code.vikunja.io/api (Go) Oct 9, 2026
Hazelcast allows arbitrary member memory access by low-privileged client Critical
CVE-2026-107726 was published for com.hazelcast:hazelcast (Maven) Oct 8, 2026
k-jamroz Credited to k-jamroz
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion Critical
CVE-2026-107722 was published for fast-jwt (npm) Oct 8, 2026
dc-infosec Credited to dc-infosec and EchoSkorJjj EchoSkorJjj EchoSkorJjj
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls Critical
CVE-2026-61445 was published for praisonai (pip) Oct 8, 2026
anushkavirgaonkar Credited to anushkavirgaonkar
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) Critical
CVE-2026-106446 was published for handlebars (npm) Oct 8, 2026
ndelphit Credited to ndelphit, bhaswanthc, dinhvaren, jmoritzc53, n0tra4e, hibrian827, sondt99, nikolakojic-rasit, Ahmed-Elmahgob, vk-can, PellaML, shenhuanageshei, kagebunsher, kustundag, ffasterss, and sanmatte bhaswanthc bhaswanthc
dinhvaren dinhvaren jmoritzc53 jmoritzc53 n0tra4e n0tra4e hibrian827 hibrian827 sondt99 sondt99 nikolakojic-rasit nikolakojic-rasit Ahmed-Elmahgob Ahmed-Elmahgob vk-can vk-can PellaML PellaML shenhuanageshei shenhuanageshei kagebunsher kagebunsher kustundag kustundag ffasterss ffasterss sanmatte sanmatte
Handlebars: JavaScript Injection via Own Property Check Bypass Critical
CVE-2026-106445 was published for handlebars (npm) Oct 8, 2026
brandon-t-elliott Credited to brandon-t-elliott
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets Critical
CVE-2026-61447 was published for praisonaiagents (pip) Oct 8, 2026
anushkavirgaonkar Credited to anushkavirgaonkar
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host Critical
CVE-2026-107282 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration Critical
CVE-2026-105697 was published for langflow (pip) Oct 7, 2026
MosesOX Credited to MosesOX, andifilhohub, and erichare andifilhohub andifilhohub
erichare erichare
Payload Form Builder has an RCE issue Critical
CVE-2026-105857 was published for @payloadcms/plugin-form-builder (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload: Unauthorized update to collection documents Critical
CVE-2026-105859 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload authentication token field handling issue Critical
CVE-2026-105863 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
vm2 contains a sandbox escape vulnerability Critical
CVE-2026-93605 was published for vm2 (npm) Oct 7, 2026
Backstage: Sensitive information exposure in Scaffolder Critical
CVE-2026-106501 was published for @backstage/plugin-scaffolder-backend (npm) Oct 7, 2026
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass Critical
CVE-2026-73487 was published for flowise (npm) Oct 7, 2026
p80n-sec Credited to p80n-sec
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium Critical
CVE-2026-73483 was published for flowise (npm) Oct 7, 2026
Skaushik-Qlys Credited to Skaushik-Qlys
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() Critical
CVE-2026-106102 was published for quasar (npm) Oct 7, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login Critical
CVE-2026-62252 was published for github.com/sipcapture/homer-app (Go) Oct 7, 2026
de3erve-hunter Credited to de3erve-hunter
Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default) Critical
CVE-2026-62253 was published for github.com/sipcapture/homer-app (Go) Oct 7, 2026
de3erve-hunter Credited to de3erve-hunter
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database