Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,163
Rust
1,615
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

113 advisories

Loading
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server Low
CVE-2026-115917 was published for vllm (pip) Oct 28, 2026
prnjlksingh Credited to prnjlksingh and jperezdealgaba jperezdealgaba jperezdealgaba
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in... High Unreviewed
CVE-2026-116748 was published Oct 27, 2026
IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an... Low Unreviewed
CVE-2026-3303 was published Oct 19, 2026
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files High
CVE-2026-108372 was published for loopx (pip) Oct 19, 2026
aeonframework Credited to aeonframework
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty... Moderate Unreviewed
CVE-2026-85313 was published Oct 19, 2026
Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP... Moderate Unreviewed
CVE-2026-84176 was published Oct 19, 2026
Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every... High Unreviewed
CVE-2026-111922 was published Oct 17, 2026
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted High
GHSA-m687-p538-r5hp was published for code.vikunja.io/api (Go) Oct 9, 2026
arthurscchan Credited to arthurscchan and AdamKorcz AdamKorcz AdamKorcz
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain Critical
GHSA-v2f8-6655-7grj was published for vibe-trading-ai (pip) Oct 2, 2026
lemi9090 Credited to lemi9090
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability,... Moderate Unreviewed
CVE-2026-66247 was published Oct 1, 2026
The open-vsx.org deployment returned Access-Control-Allow-Origin reflecting the requesting origin... High Unreviewed
CVE-2026-90882 was published Sep 22, 2026
HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to... Low Unreviewed
CVE-2026-56595 was published Sep 18, 2026
@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft High
CVE-2026-59148 was published for @mockoon/cli (npm) Sep 11, 2026
sajdakabir Credited to sajdakabir and zerotrail-ai zerotrail-ai zerotrail-ai
Windows ML CLI: CORS misconfig enables localhost RCE High
CVE-2026-84452 was published for winml-cli (pip) Sep 8, 2026
Salty43 Credited to Salty43 and slvignesh05 slvignesh05 slvignesh05
A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote... Moderate Unreviewed
CVE-2026-12962 was published Sep 8, 2026
HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing... High Unreviewed
CVE-2026-82291 was published Aug 28, 2026
Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to... High Unreviewed
CVE-2026-82287 was published Aug 28, 2026
Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with... Critical Unreviewed
CVE-2025-61163 was published Aug 26, 2026
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard Moderate
CVE-2026-68517 was published for glances (pip) Aug 17, 2026
geo-chen Credited to geo-chen
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and... High Unreviewed
CVE-2026-74881 was published Aug 17, 2026
Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads High
CVE-2026-70604 was published for electron (npm) Aug 5, 2026
proxydom Credited to proxydom
`nx graph` dev server permissive CORS policy Moderate
CVE-2026-54753 was published for nx (npm) Jul 31, 2026
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit... High Unreviewed
CVE-2026-15966 was published Jul 23, 2026
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests Critical
CVE-2026-61736 was published for lightrag-hku (pip) Jul 20, 2026
MaramHarsha Credited to MaramHarsha
HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper... Moderate Unreviewed
CVE-2026-21761 was published Jul 17, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database