Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

636 advisories

Loading
EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered,... Critical Unreviewed
CVE-2026-105037 was published Oct 15, 2026
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed... High Unreviewed
CVE-2026-111234 was published Oct 15, 2026
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with... Moderate Unreviewed
CVE-2026-111230 was published Oct 15, 2026
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path... Critical Unreviewed
CVE-2026-107594 was published Oct 14, 2026
A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows... High Unreviewed
CVE-2026-110385 was published Oct 14, 2026
External control of file name or path in Windows Update allows an authorized attacker to elevate... High Unreviewed
CVE-2026-69783 was published Oct 13, 2026
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4... Critical Unreviewed
CVE-2026-106042 was published Oct 13, 2026
Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read... High Unreviewed
CVE-2026-109601 was published Oct 13, 2026
ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated... High Unreviewed
CVE-2026-108694 was published Oct 11, 2026
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated... Moderate Unreviewed
CVE-2026-108591 was published Oct 10, 2026
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in... Moderate Unreviewed
CVE-2026-108156 was published Oct 9, 2026
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory High
CVE-2026-107377 was published for datamodel-code-generator (pip) Oct 8, 2026
alex131125 Credited to alex131125
PraisonAI: Project config can auto-save agent output outside the project root Moderate
CVE-2026-60089 was published for praisonaiagents (pip) Oct 8, 2026
rexpository Credited to rexpository
An arbitrary file manipulation vulnerability exists in the WebTools management interface of... High Unreviewed
CVE-2026-87685 was published Oct 8, 2026
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine High
CVE-2026-105744 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff, hoanggxyuuki, Smavl, 3m4n5, and Jiayang-Lai hoanggxyuuki hoanggxyuuki
Smavl Smavl 3m4n5 3m4n5 Jiayang-Lai Jiayang-Lai
Docling: Crafted DoclingDocument JSON embeds local image files into converted output Moderate
CVE-2026-105748 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff
Payload: Incomplete validation during the upload file lifecycle High
CVE-2026-105865 was published for payload (npm) Oct 7, 2026
EchoSkorJjj Credited to EchoSkorJjj
Ghost: Path Traversal via Locale Setting Moderate
CVE-2026-105676 was published for ghost (npm) Oct 7, 2026
DONG2209 Credited to DONG2209 and msegoviag msegoviag msegoviag
Backstage: Improper input validation in Confluence to Markdown scaffolder module Moderate
CVE-2026-106559 was published for @backstage/plugin-scaffolder-backend-module-confluence-to-markdown (npm) Oct 7, 2026
Backstage: Improper input validation in cloud storage URL readers Moderate
CVE-2026-106494 was published for @backstage/backend-defaults (npm) Oct 7, 2026
Quasar Framework: App Vite build cleanup can recursively remove unsafe configured output directories Moderate
CVE-2026-106109 was published for @quasar/app-vite (npm) Oct 7, 2026
hawkeye64 Credited to hawkeye64
Quasar Framework: Path Traversal / Arbitrary File Write via crafted Icon Genie profile High
CVE-2026-106103 was published for @quasar/icongenie (npm) Oct 7, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard agent could allow... Moderate Unreviewed
CVE-2026-79814 was published Oct 6, 2026
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading... Moderate Unreviewed
CVE-2026-106219 was published Oct 6, 2026
Nx: Path traversal in nx migrate package-migrations extraction Moderate
CVE-2026-104853 was published for nx (npm) Oct 5, 2026
arkmarta Credited to arkmarta
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database