Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

777 advisories

Loading
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation Moderate
CVE-2026-102682 was published for pipecat-ai (pip) Oct 15, 2026
infycore Credited to infycore and agent-kira agent-kira agent-kira
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a... Moderate Unreviewed
CVE-2026-92428 was published Oct 15, 2026
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a... Moderate Unreviewed
CVE-2026-92429 was published Oct 15, 2026
The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly... Moderate Unreviewed
CVE-2026-103324 was published Oct 15, 2026
BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability... High Unreviewed
CVE-2026-110607 was published Oct 14, 2026
The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was... Moderate Unreviewed
CVE-2026-82844 was published Oct 14, 2026
The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming... Moderate Unreviewed
CVE-2026-88998 was published Oct 14, 2026
The Visma Pay for WooCommerce WordPress plugin before 1.2.2 does not verify the authenticity of... Moderate Unreviewed
CVE-2026-103308 was published Oct 14, 2026
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is... Moderate Unreviewed
CVE-2026-108069 was published Oct 14, 2026
The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check... Moderate Unreviewed
CVE-2026-107160 was published Oct 14, 2026
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow... High Unreviewed
CVE-2026-102250 was published Oct 13, 2026
A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the... High Unreviewed
CVE-2026-108971 was published Oct 13, 2026
Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows... Moderate Unreviewed
CVE-2026-109365 was published Oct 12, 2026
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer... High Unreviewed
CVE-2026-109359 was published Oct 12, 2026
A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the... Low Unreviewed
CVE-2026-108568 was published Oct 11, 2026
Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency... Moderate Unreviewed
CVE-2026-107420 was published Oct 10, 2026
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover High
CVE-2026-62367 was published for code.vikunja.io/api (Go) Oct 9, 2026
maskop9 Credited to maskop9 and evilgensec evilgensec evilgensec
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0... Moderate Unreviewed
CVE-2026-13257 was published Oct 8, 2026
The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an... Moderate Unreviewed
CVE-2026-103517 was published Oct 8, 2026
Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME... Moderate Unreviewed
CVE-2026-105818 was published Oct 8, 2026
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write High
CVE-2026-105741 was published for langflow (pip) Oct 7, 2026
erichare Credited to erichare and andifilhohub andifilhohub andifilhohub
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing High
CVE-2026-61428 was published for praisonai (pip) Oct 7, 2026
dinhvaren Credited to dinhvaren
This vulnerability exists in the ERP system due to improper validation of payment callback... Critical Unreviewed
CVE-2026-107102 was published Oct 7, 2026
The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token... High Unreviewed
CVE-2026-82212 was published Oct 7, 2026
wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches... Critical Unreviewed
CVE-2026-16516 was published Oct 7, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database