GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
9 advisories
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
Low
CVE-2026-48978
was published
for
oras.land/oras-go
(Go)
Jul 1, 2026
melange has Path Traversal via .PKGINFO in --persist-lint-results
Low
CVE-2026-29051
was published
for
chainguard.dev/melange
(Go)
Apr 23, 2026
nimiq-transaction: Panic via `HistoryTreeProof` length mismatch
Low
CVE-2026-34067
was published
for
nimiq-transaction
(Rust)
Apr 22, 2026
webpki: Name constraints were accepted for certificates asserting a wildcard name
Low
GHSA-xgp8-3hg3-c2mh
was published
for
rustls-webpki
(Rust)
Apr 16, 2026
webpki: Name constraints for URI names were incorrectly accepted
Low
GHSA-965h-392x-2mh5
was published
for
rustls-webpki
(Rust)
Apr 16, 2026
Step CA affected by an index out of bounds panic in TPM attestation EKU validation
Low
CVE-2026-40097
was published
for
github.com/smallstep/certificates
(Go)
Apr 10, 2026
cryptography has incomplete DNS name constraint enforcement on peer names
Low
CVE-2026-34073
was published
for
cryptography
(pip)
Mar 27, 2026
Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped
Low
CVE-2026-24122
was published
for
github.com/sigstore/cosign
(Go)
Feb 19, 2026
LookupResources Cursor section tampering can crash SpiceDB process via tuple.MustParse panic
Low
GHSA-vhvq-fv9f-wh4q
was published
for
github.com/authzed/spicedb
(Go)
Feb 6, 2026
ProTip!
Advisories are also available from the
GraphQL API