Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

36,926 advisories

Loading
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash High
CVE-2026-100354 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
eros938 Credited to eros938 and hash3liZer hash3liZer hash3liZer
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path High
CVE-2026-100352 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
eros938 Credited to eros938 and hash3liZer hash3liZer hash3liZer
Talos Linux: Support bundle does not redact registry credentials Low
CVE-2026-77564 was published for github.com/talos-systems/talos (Go) Oct 15, 2026
Thanzex Credited to Thanzex
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication Critical
CVE-2026-77524 was published for github.com/kedacore/keda (Go) Oct 15, 2026
cherez0ff Credited to cherez0ff, the-vibe-dev, everping, zwindler, b0b0haha, and j311yl0v3u the-vibe-dev the-vibe-dev
everping everping zwindler zwindler b0b0haha b0b0haha j311yl0v3u j311yl0v3u
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks Critical
CVE-2026-77459 was published for github.com/argoproj/argo-cd/v2 (Go) Oct 15, 2026
RealFakeAccount Credited to RealFakeAccount, AdamKorcz, 0xshylines, thevilledev, HenriWilliams, cherez0ff, and zwindler AdamKorcz AdamKorcz
0xshylines 0xshylines thevilledev thevilledev HenriWilliams HenriWilliams cherez0ff cherez0ff zwindler zwindler
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion High
CVE-2026-100351 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
satokan Credited to satokan
Appium: Symlink based Zip Slip in @appium/support ZIP extraction Moderate
CVE-2026-103975 was published for @appium/support (npm) Oct 15, 2026
nikkoenggaliano Credited to nikkoenggaliano
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter` High
CVE-2026-103030 was published for dio_http2_adapter (Pub) Oct 15, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression Moderate
CVE-2026-100350 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
matiasinsaurralde Credited to matiasinsaurralde
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service Critical
CVE-2026-102748 was published for github.com/dgraph-io/dgraph/v25 (Go) Oct 15, 2026
0d000721999 Credited to 0d000721999
tinytag: Infinite loop when parsing certain M4A files containing invalid atoms Moderate
CVE-2026-104266 was published for tinytag (pip) Oct 15, 2026
seankohjs Credited to seankohjs and mathiascode mathiascode mathiascode
copyparty FTP: upload outside defined volumes (limited path traversal) Moderate
CVE-2026-104102 was published for copyparty (pip) Oct 15, 2026
Vitess vttablet /twopcz reflected XSS Critical
CVE-2026-104252 was published for vitess.io/vitess (Go) Oct 15, 2026
xylove21 Credited to xylove21
unstructured: Stored XSS via unescaped HTML generation Moderate
CVE-2026-104250 was published for unstructured (pip) Oct 15, 2026
hayato1121 Credited to hayato1121
mise permits untrusted local configuration to override default shell arguments High
CVE-2026-103929 was published for mise (Rust) Oct 15, 2026
arpitjain099 Credited to arpitjain099
kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) Moderate
CVE-2026-100348 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
arpitjain099 Credited to arpitjain099
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path Moderate
CVE-2026-100347 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
manus-use Credited to manus-use
Gotify: Insufficiently Protected Password Change endpoint Moderate
CVE-2026-102603 was published for github.com/gotify/server/v2 (Go) Oct 15, 2026
scumfrog Credited to scumfrog
Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes Moderate
CVE-2026-102527 was published for nuxt-og-image (npm) Oct 15, 2026
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths High
CVE-2026-100409 was published for @opennextjs/cloudflare (npm) Oct 15, 2026
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant Moderate
CVE-2026-100394 was published for github.com/nezhahq/nezha (Go) Oct 15, 2026
thesmartshadow Credited to thesmartshadow
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items High
CVE-2026-97394 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
matiasinsaurralde Credited to matiasinsaurralde
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods High
CVE-2026-85990 was published for leantime/leantime (Composer) Oct 15, 2026
tinyb0y Credited to tinyb0y
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module High
CVE-2026-82416 was published for github.com/dunglas/frankenphp (Go) Oct 15, 2026
dunglas Credited to dunglas
SFTPGo: Denial of service via malformed SSH channel request Moderate
CVE-2026-77375 was published for github.com/drakkan/sftpgo/v2 (Go) Oct 15, 2026
arnimar Credited to arnimar
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database