Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,475
Maven
5,000+
npm
5,000+
NuGet
1,091
pip
5,000+
Pub
13
RubyGems
1,144
Rust
1,511
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

518 advisories

Loading
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing High
CVE-2026-69247 was published for cryptography (pip) Aug 3, 2026
X1AOxiang Credited to X1AOxiang
HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory,... Low Unreviewed
CVE-2026-56571 was published Jul 31, 2026
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages... Low Unreviewed
CVE-2026-56568 was published Jul 31, 2026
IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9... Moderate Unreviewed
CVE-2026-11904 was published Jul 30, 2026
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in... Moderate Unreviewed
CVE-2025-59177 was published Jul 27, 2026
HCL Connections is vulnerable to information disclosure which could allow a user to obtain... Low Unreviewed
CVE-2026-56537 was published Jul 27, 2026
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile High
GHSA-ppr4-5f46-j9c6 was published for @budibase/server (npm) Jul 24, 2026
Hasinohacker Credited to Hasinohacker
Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL... Moderate Unreviewed
CVE-2026-66009 was published Jul 24, 2026
Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer... Moderate Unreviewed
CVE-2026-66008 was published Jul 24, 2026
Dompdf: Embedded SVG images can leak existence of files and directories within the filesystem Moderate
CVE-2026-59943 was published for dompdf/dompdf (Composer) Jul 22, 2026
w4tchd0ge Credited to w4tchd0ge
In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing... High Unreviewed
CVE-2026-13182 was published Jul 22, 2026
Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema... Moderate Unreviewed
CVE-2026-64627 was published Jul 21, 2026
SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where... Moderate Unreviewed
CVE-2026-63748 was published Jul 20, 2026
IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed... Moderate Unreviewed
CVE-2026-8861 was published Jul 17, 2026
mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath Moderate
CVE-2026-54561 was published for mcp-memory-keeper (npm) Jul 17, 2026
mcfly-zzh Credited to mcfly-zzh
HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages... Moderate Unreviewed
CVE-2024-23575 was published Jul 17, 2026
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel... Moderate Unreviewed
CVE-2026-56139 was published Jul 6, 2026
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty... Moderate Unreviewed
CVE-2026-49365 was published Jul 6, 2026
@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state Moderate
GHSA-qcr8-x557-7cp3 was published for @asymmetric-effort/specifyjs (npm) Jul 2, 2026
SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages Moderate
GHSA-6g9v-7gq3-p2c6 was published for surrealdb (Rust) Jul 1, 2026
Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint... Moderate Unreviewed
CVE-2026-56331 was published Jul 1, 2026
IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain... Moderate Unreviewed
CVE-2025-36328 was published Jun 30, 2026
SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter High
GHSA-cc8f-fcx3-gpjr was published for surrealdb (Rust) Jun 19, 2026
kah-ja Credited to kah-ja
canto-saas-api: OAuth credentials exposed in URL query string and exception messages Moderate
CVE-2026-55375 was published for jleehr/canto-saas-api (Composer) Jun 19, 2026
jleehr Credited to jleehr
HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is... Moderate Unreviewed
CVE-2025-59872 was published Jun 17, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database