Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

7,845 advisories

Loading
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications Moderate
CVE-2026-94543 was published for next (npm) Oct 7, 2026
Next.js has information disclosure in development server's Model Context Protocol endpoint Low
CVE-2026-94486 was published for next (npm) Oct 7, 2026
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass Moderate
CVE-2026-94485 was published for next (npm) Oct 7, 2026
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service Moderate
CVE-2026-94484 was published for next (npm) Oct 7, 2026
Next.js has Server-Side Request Forgery in Image Optimization High
CVE-2026-94483 was published for next (npm) Oct 7, 2026
Payload: SQL injection in SQLite/Postgres High
CVE-2026-105856 was published for @payloadcms/db-d1-sqlite (npm) Oct 7, 2026
HussienMisbah Credited to HussienMisbah
Payload: Remote Code Execution through first-register High
CVE-2026-105858 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload has a tenant authorization bypass in Multi-Tenant Plugin High
CVE-2026-105860 was published for @payloadcms/plugin-multi-tenant (npm) Oct 7, 2026
meifukun Credited to meifukun
Payload external upload trust validation issue High
CVE-2026-105861 was published for payload (npm) Oct 7, 2026
Payload: Bypassed sanitization of user uploaded SVGs High
CVE-2026-105862 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic and The4v1 The4v1 The4v1
@payloadcms/plugin-multi-tenant has a cross-tenant create issue Moderate
CVE-2026-105864 was published for @payloadcms/plugin-multi-tenant (npm) Oct 7, 2026
valmet083 Credited to valmet083
Payload: Incomplete validation during the upload file lifecycle High
CVE-2026-105865 was published for payload (npm) Oct 7, 2026
EchoSkorJjj Credited to EchoSkorJjj
Payload: Unauthenticated account-lockout denial of service Moderate
CVE-2026-105866 was published for payload (npm) Oct 7, 2026
nhattanhh Credited to nhattanhh
Payload: Client uploads could overwrite S3 objects High
CVE-2026-105867 was published for @payloadcms/storage-s3 (npm) Oct 7, 2026
koyokr Credited to koyokr
Payload: Uploaded XML files could execute same-origin JavaScript High
CVE-2026-105868 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload Form Builder has an RCE issue Critical
CVE-2026-105857 was published for @payloadcms/plugin-form-builder (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload: Unauthorized update to collection documents Critical
CVE-2026-105859 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload authentication token field handling issue Critical
CVE-2026-105863 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Ghost: Stored XSS via oEmbed Photo Responses High
CVE-2026-105650 was published for ghost (npm) Oct 7, 2026
nhattanhh Credited to nhattanhh
Ghost: Stored XSS via Bookmark Card Images High
CVE-2026-105651 was published for ghost (npm) Oct 7, 2026
sondt99 Credited to sondt99 and 5255fgh 5255fgh 5255fgh
Ghost: Password Hash Ordering Disclosure in Ghost Admin API Low
CVE-2026-105652 was published for ghost (npm) Oct 7, 2026
carfeii Credited to carfeii and nhattanhh nhattanhh nhattanhh
Ghost: Invite Token Disclosure in Ghost Admin API High
CVE-2026-105675 was published for ghost (npm) Oct 7, 2026
nhattanhh Credited to nhattanhh
Ghost: Path Traversal via Locale Setting Moderate
CVE-2026-105676 was published for ghost (npm) Oct 7, 2026
DONG2209 Credited to DONG2209 and msegoviag msegoviag msegoviag
Ghost: Remote Code Execution via Theme Translation Files High
CVE-2026-105677 was published for ghost (npm) Oct 7, 2026
Alemmi Credited to Alemmi, Tomer-PL, and msegoviag Tomer-PL Tomer-PL
msegoviag msegoviag
Ghost: Editors Could Promote Staff Users to Their Own Role Moderate
CVE-2026-105678 was published for ghost (npm) Oct 7, 2026
Santoshkumarpuppala Credited to Santoshkumarpuppala and nhattanhh nhattanhh nhattanhh
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database