GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
10 advisories
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
Low
GHSA-44px-qjjc-xrhq
was published
for
craftcms/cms
(Composer)
Mar 26, 2026
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
Moderate
CVE-2026-33162
was published
for
craftcms/cms
(Composer)
Mar 24, 2026
Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL
Low
CVE-2026-33160
was published
for
craftcms/cms
(Composer)
Mar 24, 2026
Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations
Moderate
CVE-2026-33159
was published
for
craftcms/cms
(Composer)
Mar 24, 2026
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Moderate
CVE-2026-33158
was published
for
craftcms/cms
(Composer)
Mar 24, 2026
OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)
Moderate
GHSA-77hf-7fqf-f227
was published
for
openclaw
(npm)
Mar 3, 2026
OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS
Moderate
CVE-2026-32011
was published
for
openclaw
(npm)
Mar 3, 2026
Wagtail Vulnerable to Cross-site Scripting in simple_translation admin interface
Moderate
CVE-2026-28223
was published
for
wagtail
(pip)
Mar 3, 2026
Wagtail Vulnerable to Cross-site Scripting in TableBlock class attributes
Moderate
CVE-2026-28222
was published
for
wagtail
(pip)
Mar 3, 2026
OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset
High
CVE-2026-27522
was published
for
openclaw
(npm)
Mar 2, 2026
ProTip!
Advisories are also available from the
GraphQL API