Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,521
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,145
Rust
1,514
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

4,539 advisories

Loading
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle Critical
CVE-2026-73080 was published for github.com/seaweedfs/seaweedfs (Go) Aug 11, 2026
KadirArslan Credited to KadirArslan
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain Critical
CVE-2026-71851 was published for crypto-js (npm) Aug 7, 2026
juli Credited to juli
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules Critical
CVE-2026-63223 was published for codeigniter4/framework (Composer) Aug 7, 2026
wnsgurd90-keke Credited to wnsgurd90-keke
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions Critical
CVE-2026-63221 was published for codeigniter4/framework (Composer) Aug 7, 2026
gr8man Credited to gr8man
Craft CMS: Passkey login accepts replayed WebAuthn assertions Critical
GHSA-wg23-69c2-gjc8 was published for craftcms/cms (Composer) Aug 7, 2026
Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware Critical
CVE-2026-65600 was published for github.com/traefik/traefik (Go) Aug 6, 2026
C-h4ck-0 Credited to C-h4ck-0
Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host Critical
CVE-2026-71319 was published for @nuxt/devtools (npm) Aug 5, 2026
TazmiDev Credited to TazmiDev and anzuukino anzuukino anzuukino
Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service Critical
CVE-2026-70478 was published for flowise (npm) Aug 4, 2026
DeathsPirate Credited to DeathsPirate
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability Critical
CVE-2026-70477 was published for flowise (npm) Aug 4, 2026
zdi-disclosures Credited to zdi-disclosures
Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation Critical
CVE-2026-69264 was published for flowise (npm) Aug 4, 2026
amwhoi Credited to amwhoi
Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE Critical
CVE-2026-70470 was published for flowise (npm) Aug 4, 2026
fg0x0 Credited to fg0x0
Flowise RCE via SQLite Record Manager Node Critical
CVE-2026-69259 was published for flowise (npm) Aug 4, 2026
alex-elttam Credited to alex-elttam
Flowise: Remote Code Execution Vulnerability in CSVAgent Critical
CVE-2026-69256 was published for flowise (npm) Aug 4, 2026
jia-elttam Credited to jia-elttam
Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified Critical
CVE-2026-69255 was published for flowise (npm) Aug 4, 2026
lexi-core-ai Credited to lexi-core-ai
Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override Critical
CVE-2026-69254 was published for flowise (npm) Aug 4, 2026
akshat-sj Credited to akshat-sj
Flowise Sandbox Escape to RCE Critical
CVE-2026-69253 was published for flowise (npm) Aug 4, 2026
alex-elttam Credited to alex-elttam
Flowise RCE via TypeORM DataSource Critical
CVE-2026-69251 was published for flowise (npm) Aug 4, 2026
alex-elttam Credited to alex-elttam
Sequelize: SQL Injection (Oracle DB) Critical
CVE-2026-69240 was published for sequelize (npm) Aug 3, 2026
t-tera Credited to t-tera
Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass Critical
CVE-2026-53609 was published for apostrophe (npm) Jul 31, 2026
H3xV0rT3x Credited to H3xV0rT3x
NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE Critical
CVE-2026-52887 was published for @nocobase/plugin-notification-in-app-message (npm) Jul 31, 2026
kah-ja Credited to kah-ja
vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API Critical
CVE-2026-54725 was published for github.com/bank-vaults/vault-secrets-webhook (Go) Jul 31, 2026
0xVijay Credited to 0xVijay
Wings exposes node configuration secrets through egg configuration-file templating Critical
CVE-2026-52855 was published for github.com/pterodactyl/wings (Go) Jul 31, 2026
robertdrakedennis Credited to robertdrakedennis
AWS Amplify Studio UI Component Properties Has an Input Validation Issue Critical
CVE-2025-4318 was published for @aws-amplify/codegen-ui-react (npm) Jul 30, 2026
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing Critical
CVE-2026-66066 was published for activestorage (RubyGems) Jul 30, 2026
0xacb Credited to 0xacb, Ry0taK, flavorjones, jeremy, byroot, ethiack-admin, s3np41k1r1t0, castilho101, and rafaelfranca Ry0taK Ry0taK
flavorjones flavorjones jeremy jeremy byroot byroot ethiack-admin ethiack-admin s3np41k1r1t0 s3np41k1r1t0 castilho101 castilho101 rafaelfranca rafaelfranca
Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration Critical
CVE-2026-67426 was published for flyto-core (pip) Jul 30, 2026
manus-use Credited to manus-use and BarakSrour BarakSrour BarakSrour
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database