Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,535
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,515
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.

254 advisories

Loading
Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection)... High Unreviewed
CVE-2026-73682 was published Aug 14, 2026
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the... High Unreviewed
CVE-2026-73624 was published Aug 13, 2026
GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method... Moderate Unreviewed
CVE-2026-73621 was published Aug 13, 2026
PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags... Critical Unreviewed
CVE-2026-16770 was published Aug 13, 2026
Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue... Critical Unreviewed
CVE-2026-73240 was published Aug 12, 2026
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users... High Unreviewed
CVE-2026-72538 was published Aug 11, 2026
xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core... Moderate Unreviewed
CVE-2026-71212 was published Aug 5, 2026
A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to... High Unreviewed
CVE-2026-18157 was published Jul 31, 2026
An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia... High Unreviewed
CVE-2026-43698 was published Jul 27, 2026
A flaw was found in the Visual Studio Code Ansible Lightspeed extension's... High Unreviewed
CVE-2026-44189 was published Jul 22, 2026
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's... High Unreviewed
CVE-2026-16493 was published Jul 21, 2026
FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line... High Unreviewed
CVE-2026-64624 was published Jul 21, 2026
Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH... High Unreviewed
CVE-2026-47829 was published Jul 9, 2026
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability... Critical Unreviewed
CVE-2026-40047 was published Jul 6, 2026
Improper neutralization of argument delimiters in a command ('argument injection') vulnerability... High Unreviewed
CVE-2026-14459 was published Jul 3, 2026
A flaw was found in the vscode-java extension, which provides Java language support for Visual... High Unreviewed
CVE-2026-12856 was published Jun 29, 2026
Argument Injection in TortoiseGitBlame via Malicious Git History Filenames Leads to Arbitrary... Moderate Unreviewed
CVE-2026-11968 was published Jun 24, 2026
Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM,... Critical Unreviewed
CVE-2026-47365 was published Jun 12, 2026
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability... High Unreviewed
CVE-2026-53694 was published Jun 10, 2026
Input validation bypass in SMB volume mount handling in CloudFoundry Foundation diego-release... High Unreviewed
CVE-2026-41013 was published Jun 1, 2026
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection... High Unreviewed
CVE-2026-49373 was published May 29, 2026
IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote... High Unreviewed
CVE-2026-47114 was published May 21, 2026
The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection... Critical Unreviewed
CVE-2026-31230 was published May 12, 2026
An improper neutralization of argument delimiters in a command ('argument injection')... Moderate Unreviewed
CVE-2026-25690 was published May 12, 2026
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM... Moderate Unreviewed
CVE-2025-40948 was published May 12, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database