Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

9 advisories

Loading
Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign) Moderate
CVE-2026-62322 was published for social-auth-core (pip) Oct 15, 2026
thientd Credited to thientd and nijel nijel nijel
Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution High
CVE-2026-61586 was published for eu.copernik:copernik-xml-factory (Maven) Oct 2, 2026
thientd Credited to thientd and gladiator9797 gladiator9797 gladiator9797
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization Moderate
CVE-2026-77310 was published for com.fasterxml.jackson.core:jackson-databind (Maven) Sep 28, 2026
thientd Credited to thientd and pussycat0x pussycat0x pussycat0x
Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header Moderate
CVE-2026-62987 was published for github.com/fabiolb/fabio (Go) Sep 22, 2026
thientd Credited to thientd
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799) High
CVE-2026-63126 was published for com.squareup.wire:wire-runtime (Maven) Sep 17, 2026
thientd Credited to thientd and gladiator9797 gladiator9797 gladiator9797
Wagtail: Improper restriction handling on descendant collections in Documents and Images API Moderate
GHSA-c2xx-cjmh-9q8f was published for wagtail (pip) Aug 20, 2026
gasman Credited to gasman, RealOrangeOne, and thientd RealOrangeOne RealOrangeOne
thientd thientd
Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection High
CVE-2026-62982 was published for glances (pip) Aug 17, 2026
thientd Credited to thientd
Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) Moderate
CVE-2026-65835 was published for github.com/projectcapsule/capsule (Go) Jul 31, 2026
thientd Credited to thientd
Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298) Moderate
CVE-2026-59729 was published for astro (npm) Jul 20, 2026
thientd Credited to thientd
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database