Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
50
Go
3,606
Maven
5,000+
npm
5,000+
NuGet
924
pip
4,831
Pub
13
RubyGems
1,045
Rust
1,256
Swift
53
Unreviewed advisories
All unreviewed
5,000+

215 advisories

Loading
BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2... Critical Unreviewed
CVE-2026-39920 was published Apr 24, 2026
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud High
CVE-2026-41432 was published for github.com/QuantumNous/new-api (Go) Apr 24, 2026
Calcium-Ion Credited to Calcium-Ion, ChangeYu0229, and kainordherd ChangeYu0229 ChangeYu0229
kainordherd kainordherd
P4 Server versions prior to 2026.1 are configured with insecure default settings that, when... High Unreviewed
CVE-2026-6043 was published Apr 24, 2026
Gitea has insecure default SSH settings Moderate
GHSA-3m6q-h5gj-7mrw was published for code.gitea.io/gitea (Go) Apr 22, 2026
gnzsnz Credited to gnzsnz
engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection High
GHSA-2r2p-4cgf-hv7h was published for engramx (npm) Apr 22, 2026
gabiudrescu Credited to gabiudrescu
Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC... High Unreviewed
CVE-2026-32965 was published Apr 20, 2026
OpenClaw: Feishu webhook and card-action validation now fail closed Critical
GHSA-xh72-v6v9-mwhc was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
OpenClaw: Browser SSRF policy default allowed private-network navigation Moderate
GHSA-53vx-pmqw-863c was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass Critical
GHSA-68qg-g8mg-6pr7 was published for @paperclipai/server (npm) Apr 10, 2026
sagilayani Credited to sagilayani
OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default... Critical Unreviewed
CVE-2026-28205 was published Apr 9, 2026
openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools Moderate
CVE-2026-39398 was published for openclaw-claude-bridge (npm) Apr 8, 2026
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist Critical
CVE-2026-31818 was published for @budibase/backend-core (npm) Apr 3, 2026
Moonster8282 Credited to Moonster8282
Electron: Context Isolation bypass via contextBridge VideoFrame transfer High
CVE-2026-34780 was published for electron (npm) Apr 3, 2026
DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost High
CVE-2026-34742 was published for github.com/modelcontextprotocol/go-sdk (Go) Apr 1, 2026
JLLeitschuh Credited to JLLeitschuh
NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an... High Unreviewed
CVE-2026-24148 was published Mar 31, 2026
Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability Moderate
GHSA-q94v-v6m9-jhq9 was published for openclaw (npm) Mar 21, 2026 • withdrawn
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection High
CVE-2026-31975 was published for @siteboon/claude-code-ui (npm) Mar 11, 2026
Ethan-Yang-opcia Credited to Ethan-Yang-opcia, DhiyaneshGeek, and neo-ai-engineer DhiyaneshGeek DhiyaneshGeek
neo-ai-engineer neo-ai-engineer
AMPPS 2.7 contains a denial of service vulnerability that allows remote attackers to crash the... High Unreviewed
CVE-2018-25169 was published Mar 6, 2026
Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers... High Unreviewed
CVE-2018-25193 was published Mar 6, 2026
Microsoft ACI Confidential Containers Information Disclosure Vulnerability Moderate Unreviewed
CVE-2026-26122 was published Mar 6, 2026
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of... Critical Unreviewed
CVE-2026-28775 was published Mar 4, 2026
UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default... Critical Unreviewed
CVE-2025-70998 was published Feb 18, 2026
A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of... Moderate Unreviewed
CVE-2026-2617 was published Feb 17, 2026
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise Critical
CVE-2026-26190 was published for github.com/milvus-io/milvus (Go) Feb 11, 2026
0x1f Credited to 0x1f
The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all... Moderate Unreviewed
CVE-2026-1675 was published Feb 7, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database