GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
6 advisories
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts
Moderate
GHSA-957r-qf9p-67xw
was published
for
craftcms/cms
(Composer)
Aug 6, 2026
Craft CMS: Stored XSS in the control panel via unescaped draft name
Moderate
GHSA-2rp4-x2j7-qmcc
was published
for
craftcms/cms
(Composer)
Aug 6, 2026
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
High
CVE-2026-54910
was published
for
github.com/gtsteffaniak/filebrowser/backend
(Go)
Jul 31, 2026
File Browser: Colliding username normalization gives two users the same home directory
High
CVE-2026-62685
was published
for
github.com/filebrowser/filebrowser/v2
(Go)
Jul 20, 2026
File Browser: Share API exposes the password hash and bypass token
Low
CVE-2026-62684
was published
for
github.com/filebrowser/filebrowser/v2
(Go)
Jul 20, 2026
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
Moderate
CVE-2026-62843
was published
for
github.com/filebrowser/filebrowser/v2
(Go)
Jul 20, 2026
ProTip!
Advisories are also available from the
GraphQL API