Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
55
Go
4,533
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,145
Rust
1,514
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

34,479 advisories

Loading
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id High
CVE-2026-69148 was published for mlflow (npm) Aug 17, 2026
geo-chen Credited to geo-chen
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth Moderate
CVE-2026-69146 was published for mlflow (npm) Aug 17, 2026
geo-chen Credited to geo-chen
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) Critical
CVE-2026-64849 was published for mlflow (pip) Aug 17, 2026
freeman-bb Credited to freeman-bb, y011d4, ibondarenko1, h1-mrz, and th3cyb3rc0p y011d4 y011d4
ibondarenko1 ibondarenko1 h1-mrz h1-mrz th3cyb3rc0p th3cyb3rc0p
9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint High
CVE-2026-56677 was published for 9router (npm) Aug 17, 2026
HK4zCzi Credited to HK4zCzi
http4k: `DigestAuthProvider.verify` did not bind to request URI High
CVE-2026-54148 was published for org.http4k:http4k-security-digest (Maven) Aug 17, 2026
http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI Moderate
CVE-2026-54147 was published for org.http4k:http4k-security-digest (Maven) Aug 17, 2026
chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots Moderate
CVE-2026-53766 was published for chrome-devtools-mcp (npm) Aug 17, 2026
enable7997 Credited to enable7997
package pkcs12: Authentication bypass in Decode functions Moderate
GHSA-mpwr-8vm7-h73f was published for software.sslmate.com/src/go-pkcs12 (Go) Aug 17, 2026
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service High
CVE-2026-53752 was published for org.docx4j:docx4j-core (Maven) Aug 17, 2026
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS High
CVE-2026-53659 was published for org.http4k:http4k-core (Maven) Aug 17, 2026
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard High
GHSA-j659-8xh6-5pq5 was published for atomic-agents-stack (pip) Aug 17, 2026
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE) High
GHSA-xhcr-cqfr-m3hv was published for atomic-agents-stack (pip) Aug 17, 2026
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite Moderate
CVE-2026-59903 was published for io.netty:netty-codec-http (Maven) Aug 17, 2026
violetagg Credited to violetagg
Netty: Memory Exhaustion in SctpMessageCompletionHandler High
CVE-2026-59902 was published for io.netty:netty-transport-sctp (Maven) Aug 17, 2026
violetagg Credited to violetagg
uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set High
GHSA-fhgh-wq4q-r37x was published for gitlab.com/uniget-org/cli (Go) Aug 17, 2026
arpitjain099 Credited to arpitjain099
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service) High
CVE-2026-59893 was published for sqlparse (pip) Aug 17, 2026
EQSTLab Credited to EQSTLab, min8282, and 7thParkk min8282 min8282
7thParkk 7thParkk
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger High
CVE-2026-54284 was published for sqlparse (pip) Aug 17, 2026
tonghuaroot Credited to tonghuaroot
Etherpad has stored XSS in HTML export via unescaped attribute-pool values High
CVE-2026-55090 was published for ep_etherpad-lite (npm) Aug 17, 2026
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling Moderate
GHSA-92hr-gmr6-h8cp was published for ep_etherpad-lite (npm) Aug 17, 2026
uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability Moderate
CVE-2026-55062 was published for gitlab.com/uniget-org/cli (Go) Aug 17, 2026
0x5t4l1n Credited to 0x5t4l1n and Chris35t Chris35t Chris35t
uniget CLI has an EDITOR Command Injection Moderate
CVE-2026-55061 was published for gitlab.com/uniget-org/cli (Go) Aug 17, 2026
0x5t4l1n Credited to 0x5t4l1n and Chris35t Chris35t Chris35t
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass High
GHSA-v836-6xw4-9cx3 was published for vm2 (npm) Aug 17, 2026
Kr1shna4garwal Credited to Kr1shna4garwal
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f) Critical
GHSA-m5w8-4gq2-6f8x was published for vm2 (npm) Aug 17, 2026
offset Credited to offset
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators Critical
CVE-2026-47698 was published for vm2 (npm) Aug 17, 2026
XmiliaH Credited to XmiliaH, the-vibe-dev, oran-s, dinhvaren, zolbooo, nil340, rexpository, and lukefr09 the-vibe-dev the-vibe-dev
oran-s oran-s dinhvaren dinhvaren zolbooo zolbooo nil340 nil340 rexpository rexpository lukefr09 lukefr09
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE Critical
CVE-2026-47686 was published for vm2 (npm) Aug 17, 2026
VladimirEliTokarev Credited to VladimirEliTokarev
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database