GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
PostCSS has XSS via Unescaped </style> in its CSS Stringify Output
Moderate
CVE-2026-41305
was published
for
postcss
(npm)
Apr 24, 2026
xmldom has XML injection through unvalidated DocumentType serialization
High
CVE-2026-41674
was published
for
@xmldom/xmldom
(npm)
Apr 22, 2026
xmldom has XML node injection through unvalidated processing instruction serialization
High
CVE-2026-41675
was published
for
@xmldom/xmldom
(npm)
Apr 22, 2026
xmldom has XML node injection through unvalidated comment serialization
High
CVE-2026-41672
was published
for
@xmldom/xmldom
(npm)
Apr 22, 2026
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
Moderate
CVE-2026-41650
was published
for
fast-xml-parser
(npm)
Apr 22, 2026
MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splitting
High
CVE-2026-39884
was published
for
mcp-server-kubernetes
(npm)
Apr 14, 2026
mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
High
CVE-2026-39885
was published
for
@frontmcp/adapters
(npm)
Apr 8, 2026
ProTip!
Advisories are also available from the
GraphQL API