Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,455 advisories

Loading
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses Critical
CVE-2026-102989 was published for @tanstack/react-start (npm) Oct 15, 2026
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment Critical
CVE-2026-108261 was published for @tinacms/app (npm) Oct 9, 2026
sondt99 Credited to sondt99
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion Critical
CVE-2026-107722 was published for fast-jwt (npm) Oct 8, 2026
dc-infosec Credited to dc-infosec and EchoSkorJjj EchoSkorJjj EchoSkorJjj
Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) Critical
CVE-2026-106446 was published for handlebars (npm) Oct 8, 2026
ndelphit Credited to ndelphit, bhaswanthc, dinhvaren, jmoritzc53, n0tra4e, hibrian827, sondt99, nikolakojic-rasit, Ahmed-Elmahgob, vk-can, PellaML, shenhuanageshei, kagebunsher, kustundag, ffasterss, and sanmatte bhaswanthc bhaswanthc
dinhvaren dinhvaren jmoritzc53 jmoritzc53 n0tra4e n0tra4e hibrian827 hibrian827 sondt99 sondt99 nikolakojic-rasit nikolakojic-rasit Ahmed-Elmahgob Ahmed-Elmahgob vk-can vk-can PellaML PellaML shenhuanageshei shenhuanageshei kagebunsher kagebunsher kustundag kustundag ffasterss ffasterss sanmatte sanmatte
Handlebars: JavaScript Injection via Own Property Check Bypass Critical
CVE-2026-106445 was published for handlebars (npm) Oct 8, 2026
brandon-t-elliott Credited to brandon-t-elliott
Payload Form Builder has an RCE issue Critical
CVE-2026-105857 was published for @payloadcms/plugin-form-builder (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload: Unauthorized update to collection documents Critical
CVE-2026-105859 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
Payload authentication token field handling issue Critical
CVE-2026-105863 was published for payload (npm) Oct 7, 2026
Zerotistic Credited to Zerotistic
vm2 contains a sandbox escape vulnerability Critical
CVE-2026-93605 was published for vm2 (npm) Oct 7, 2026
Backstage: Sensitive information exposure in Scaffolder Critical
CVE-2026-106501 was published for @backstage/plugin-scaffolder-backend (npm) Oct 7, 2026
Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass Critical
CVE-2026-73487 was published for flowise (npm) Oct 7, 2026
p80n-sec Credited to p80n-sec
Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium Critical
CVE-2026-73483 was published for flowise (npm) Oct 7, 2026
Skaushik-Qlys Credited to Skaushik-Qlys
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() Critical
CVE-2026-106102 was published for quasar (npm) Oct 7, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Payload: Field access control bypass on auth collections Critical
CVE-2026-105851 was published for payload (npm) Oct 6, 2026
Zerotistic Credited to Zerotistic
Payload: Prototype pollution in Payload Import Export plugin Critical
CVE-2026-105844 was published for @payloadcms/plugin-import-export (npm) Oct 6, 2026
iamnoooob Credited to iamnoooob
Payload: SQL Injection in SQLite and Postgres Critical
CVE-2026-105845 was published for payload (npm) Oct 6, 2026
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token Critical
CVE-2026-102422 was published for shell-quote (npm) Oct 6, 2026
euriconicacio Credited to euriconicacio and ljharb ljharb ljharb
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection Critical
CVE-2026-102829 was published for @simple-git/argv-parser (npm) Oct 5, 2026
simple-git unsafe-operation guard does not block trailer command configuration Critical
CVE-2026-102828 was published for simple-git (npm) Oct 5, 2026
sec-reex Credited to sec-reex
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) Critical
CVE-2026-104846 was published for seroval (npm) Oct 5, 2026
Sicks3c Credited to Sicks3c
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet Critical
CVE-2026-90711 was published for proxy-addr (npm) Oct 5, 2026
kagebunsher Credited to kagebunsher, UlisesGascon, and kustundag UlisesGascon UlisesGascon
kustundag kustundag
vm2: NodeVM custom resolution bypasses external path boundaries Critical
CVE-2026-100721 was published for vm2 (npm) Oct 5, 2026
rexpository Credited to rexpository
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path Critical
CVE-2026-103922 was published for @capacitor/android (Maven) Oct 5, 2026
andredestro Credited to andredestro
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution Critical
CVE-2026-104848 was published for tinypool (npm) Oct 5, 2026
ambushneupane Credited to ambushneupane
Tinypool: Prototype Pollution Gadget to RCE in run() options Critical
CVE-2026-104849 was published for tinypool (npm) Oct 5, 2026
Fcmam5 Credited to Fcmam5
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database