Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

63 advisories

Loading
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption High
CVE-2026-119283 was published for joserfc (pip) Oct 30, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials High
CVE-2026-62290 was published for github.com/cert-manager/cert-manager (Go) Oct 29, 2026
kamil-sawicki Credited to kamil-sawicki, robertprast, and EQSTLab robertprast robertprast
EQSTLab EQSTLab
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy High
GHSA-w9x9-j56r-h98r was published for @eeacms/volto-chatbot (npm) Oct 29, 2026
EQSTLab Credited to EQSTLab
mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 High
GHSA-4mfg-r38w-w8fg was published for mcp-sanitizer (npm) Oct 28, 2026
EQSTLab Credited to EQSTLab and knm6777 knm6777 knm6777
mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths High
GHSA-7w82-6f9j-v9jp was published for mcp-sanitizer (npm) Oct 28, 2026
EQSTLab Credited to EQSTLab and yym8538 yym8538 yym8538
Authlib: Default JWT bearer grant accepts assertions for the wrong audience Moderate
CVE-2026-114618 was published for authlib (pip) Oct 27, 2026
mauriceng98 Credited to mauriceng98, EQSTLab, and alham-rizvi EQSTLab EQSTLab
alham-rizvi alham-rizvi
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter` High
CVE-2026-103030 was published for dio_http2_adapter (Pub) Oct 15, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS High
CVE-2026-104827 was published for react/http (Composer) Oct 15, 2026
EQSTLab Credited to EQSTLab, WyriHaximus, and 232-323 WyriHaximus WyriHaximus
232-323 232-323
ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service High
CVE-2026-107839 was published for github.com/luskaner/ageLANServer/server (Go) Oct 9, 2026
EQSTLab Credited to EQSTLab and knm6777 knm6777 knm6777
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor High
CVE-2026-103921 was published for @graphql-tools/executor-legacy-ws (npm) Oct 5, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions Critical
CVE-2026-10032 was published for @a2ui/web_core (npm) Oct 2, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests High
CVE-2026-57443 was published for scbe-aethermoore (pip) Sep 25, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint) High
CVE-2026-59723 was published for cline (npm) Sep 24, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata High
CVE-2026-61782 was published for @rsdoctor/rspack-plugin (npm) Sep 24, 2026
EQSTLab Credited to EQSTLab
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path High
CVE-2026-77246 was published for mcp-atlassian (pip) Sep 22, 2026
EQSTLab Credited to EQSTLab and 232-323 232-323 232-323
Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion High
GHSA-xwmw-prc4-v3cr was published for github.com/obot-platform/obot (Go) Sep 18, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover Critical
CVE-2026-59151 was published for prowler-cloud (pip) Sep 11, 2026
EQSTLab Credited to EQSTLab, AdriiiPRodri, jfagoagas, and josema-xyz AdriiiPRodri AdriiiPRodri
jfagoagas jfagoagas josema-xyz josema-xyz
@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission High
CVE-2026-59965 was published for @jhb.software/payload-alt-text-plugin (npm) Sep 10, 2026
EQSTLab Credited to EQSTLab, 232-323, and Kxrma47 232-323 232-323
Kxrma47 Kxrma47
@argos-ci/core: CI Branch Name OS Command Injection High
CVE-2026-59960 was published for @argos-ci/core (npm) Sep 10, 2026
EQSTLab Credited to EQSTLab and yym8538 yym8538 yym8538
mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS High
GHSA-m3wp-48jr-vr4g was published for mistralrs-server-core (Rust) Sep 10, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
@openhop/server: Path Traversal in Flow ID File Operations High
CVE-2026-59179 was published for @openhop/server (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import High
CVE-2026-59176 was published for functype-mcp-server (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab and ranjiGT ranjiGT ranjiGT
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run High
CVE-2026-59160 was published for @yeger/turbo-graph (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients High
CVE-2026-59158 was published for nuxt-ollama (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab
TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop High
GHSA-7q9c-hpx7-9cwm was published for @typespec/spector (npm) Sep 4, 2026
EQSTLab Credited to EQSTLab and knm6777 knm6777 knm6777
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database