Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
74
GitHub Actions
54
Go
4,092
Maven
5,000+
npm
5,000+
NuGet
994
pip
5,000+
Pub
13
RubyGems
1,095
Rust
1,414
Swift
61
Unreviewed advisories
All unreviewed
5,000+

128,995 advisories

Loading
Gogs has the ability to import local repositories via Mirror Settings High
CVE-2026-52801 was published for gogs.io/gogs (Go) Jun 23, 2026
KKC73 Credited to KKC73
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover High
CVE-2026-52800 was published for gogs.io/gogs (Go) Jun 23, 2026
odgrso Credited to odgrso
Gogs Missing Authorization in Attachment Download High
CVE-2026-52799 was published for gogs.io/gogs (Go) Jun 22, 2026
odgrso Credited to odgrso
Gogs has Stored XSS in `.ipynb` Preview High
CVE-2026-52798 was published for gogs.io/gogs (Go) Jun 22, 2026
odgrso Credited to odgrso
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation High
CVE-2026-54353 was published for @budibase/backend-core (npm) Jun 22, 2026
Artex09 Credited to Artex09
Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override High
CVE-2026-54351 was published for @budibase/server (npm) Jun 22, 2026
offset Credited to offset
@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens High
CVE-2026-49229 was published for @actual-app/sync-server (npm) Jun 22, 2026
pyuysig Credited to pyuysig and MatissJanis MatissJanis MatissJanis
Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials High
CVE-2026-50137 was published for @budibase/server (npm) Jun 22, 2026
tonghuaroot Credited to tonghuaroot
Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials High
CVE-2026-50136 was published for @budibase/server (npm) Jun 22, 2026
liyander Credited to liyander
Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF High
CVE-2026-50132 was published for @budibase/server (npm) Jun 22, 2026
VishaaLlKumaaRr Credited to VishaaLlKumaaRr
Budibase: SSRF via OAuth2 token endpoint URL reaches internal hosts and cloud metadata High
CVE-2026-48153 was published for @budibase/server (npm) Jun 22, 2026
adrgs Credited to adrgs and aisafe-bot aisafe-bot aisafe-bot
skillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgery High
GHSA-74p7-6h78-gw8p was published for skillctl (Rust) Jun 22, 2026
Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users... High Unreviewed
CVE-2026-39904 was published Jun 22, 2026
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution... High Unreviewed
CVE-2026-44274 was published Jun 22, 2026
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization... High Unreviewed
CVE-2026-44271 was published Jun 22, 2026
Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization... High Unreviewed
CVE-2026-44272 was published Jun 22, 2026
WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows... High Unreviewed
CVE-2026-53779 was published Jun 22, 2026
A command injection vulnerability has been identified in the DHCP option processing logic in... High Unreviewed
CVE-2026-11834 was published Jun 22, 2026
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533) High
CVE-2026-46608 was published for glances (pip) Jun 22, 2026
sectroyer Credited to sectroyer
Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution High
CVE-2026-46607 was published for glances (pip) Jun 22, 2026
sectroyer Credited to sectroyer
Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py High
CVE-2026-46606 was published for glances (pip) Jun 22, 2026
sectroyer Credited to sectroyer
Spinnaker has uon-safe yaml deserialization, allowing RCE when using specific types High
CVE-2026-44795 was published for io.spinnaker.orca:orca-core (Maven) Jun 22, 2026
OpenAM has LDAP Injection via `_queryId` Parameter High
CVE-2026-41573 was published for org.openidentityplatform.openam:openam-core-rest (Maven) Jun 22, 2026
nn0nkey Credited to nn0nkey
ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420) High
CVE-2025-67303 was published for comfyui-manager (pip) Jun 22, 2026
AVideo Vulnerable to Unauthenticated .env File Exposure via Official Docker Compose Configuration High
CVE-2026-33692 was published for wwbn/avideo (Composer) Jun 22, 2026
morimori-dev Credited to morimori-dev
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database