Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,549
Maven
5,000+
npm
5,000+
NuGet
917
pip
4,798
Pub
13
RubyGems
1,038
Rust
1,237
Swift
53
Unreviewed advisories
All unreviewed
5,000+

29,712 advisories

Loading
Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where... Critical Unreviewed
CVE-2026-39918 was published Apr 20, 2026
SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file... Critical Unreviewed
CVE-2026-5760 was published Apr 20, 2026
A possible security vulnerability has been identified in Apache Kafka. By default, the broker... Critical Unreviewed
CVE-2026-33557 was published Apr 20, 2026
A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability... Critical Unreviewed
CVE-2026-6644 was published Apr 20, 2026
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated... Critical Unreviewed
CVE-2026-5963 was published Apr 20, 2026
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated... Critical Unreviewed
CVE-2026-5964 was published Apr 20, 2026
SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow... Critical Unreviewed
CVE-2026-32956 was published Apr 20, 2026
Dag Authors, who normally should not be able to execute code in the webserver context could craft... Critical Unreviewed
CVE-2026-25917 was published Apr 18, 2026
Zebra Vulnerable to Consensus Divergence in Transparent Sighash Hash-Type Handling Critical
GHSA-8m29-fpq5-89jj was published for zebra-script (Rust) Apr 18, 2026
conradoplg Credited to conradoplg, mpguerra, and sangsoo-osec mpguerra mpguerra
sangsoo-osec sangsoo-osec
Zebra has rk Identity Point Panic in Transaction Verification Critical
GHSA-452v-w3gx-72wg was published for zebra-chain (Rust) Apr 18, 2026
mpguerra Credited to mpguerra
Wish has SCP Path Traversal that allows arbitrary file read/write Critical
GHSA-xjvp-7243-rg9h was published for charm.land/wish/v2 (Go) Apr 18, 2026
evnsh Credited to evnsh and aymanbagabas aymanbagabas aymanbagabas
Nhost Vulnerable to Account Takeover via OAuth Email Verification Bypass Critical
GHSA-6g38-8j4p-j3pr was published for github.com/nhost/nhost (Go) Apr 18, 2026
skoveit Credited to skoveit
Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability Critical
GHSA-v38x-c887-992f was published for flowise (npm) Apr 18, 2026
zdi-disclosures Credited to zdi-disclosures
OpenClaw: Feishu webhook and card-action validation now fail closed Critical
GHSA-xh72-v6v9-mwhc was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
Remote Code Execution (RCE) via String Literal Injection into math-codegen Critical
GHSA-p6x5-p4xf-cc4r was published for math-codegen (npm) Apr 17, 2026
hits3134 Credited to hits3134
Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI Critical
GHSA-9qhq-v63v-fv3j was published for praisonai (pip) Apr 17, 2026
decsecre583 Credited to decsecre583
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted ... Critical Unreviewed
CVE-2026-35546 was published Apr 17, 2026
OpenViking prior to commit c7bb167 contains an authentication bypass vulnerability in the... Critical Unreviewed
CVE-2026-40525 was published Apr 17, 2026
Sentry: Improper authentication on SAML SSO process allows user identity linking Critical
CVE-2026-27197 was published for sentry (pip) Apr 17, 2026
Muhammad-Qasim-Munir Credited to Muhammad-Qasim-Munir
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration Critical
CVE-2026-23500 was published for dolibarr/dolibarr (Composer) Apr 17, 2026
lukasz-rybak Credited to lukasz-rybak
An attacker with network access to the PLC is able to brute force discover passwords to gain... Critical Unreviewed
CVE-2026-6284 was published Apr 17, 2026
Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc... Critical Unreviewed
CVE-2025-14813 was published Apr 17, 2026
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core... Critical Unreviewed
CVE-2026-5598 was published Apr 17, 2026
A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote... Critical Unreviewed
CVE-2026-37749 was published Apr 17, 2026
Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database... Critical Unreviewed
CVE-2025-15625 was published Apr 17, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database