Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

36,926 advisories

Loading
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) High
CVE-2026-96627 was published for github.com/getarcaneapp/arcane/backend/v2 (Go) Oct 16, 2026
manus-use Credited to manus-use
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` Moderate
CVE-2026-96628 was published for github.com/getarcaneapp/arcane/backend/v2 (Go) Oct 16, 2026
gehan-psbc Credited to gehan-psbc
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport Critical
CVE-2026-105192 was published for lmcache (pip) Oct 16, 2026
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content High
CVE-2026-100349 was published for github.com/getkin/kin-openapi (Go) Oct 16, 2026
vnykmshr Credited to vnykmshr
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination Moderate
CVE-2026-58494 was published for wasmtime-wasi (Rust) Oct 16, 2026
sdjasj Credited to sdjasj
lopdf has a stack overflow via deeply nested PDF objects High
GHSA-6fj4-rcr3-r7rr was published for lopdf (Rust) Oct 16, 2026
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS High
CVE-2026-102834 was published for org.bytedeco:javacv (Maven) Oct 16, 2026
tinyb0y Credited to tinyb0y
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin Low
CVE-2026-62994 was published for github.com/coredns/coredns (Go) Oct 16, 2026
sondt99 Credited to sondt99
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) Low
CVE-2026-76894 was published for @aborruso/ckan-mcp-server (npm) Oct 16, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
swoosh has email-derived URL path injection in Microsoft Graph endpoint Low
CVE-2026-54893 was published for swoosh (Erlang) Oct 16, 2026
PJUllrich Credited to PJUllrich, maennchen, and princemaple maennchen maennchen
princemaple princemaple
ClickMigrate has Path Traversal in "revision -m" argument Low
CVE-2026-68549 was published for ClickMigrate (pip) Oct 16, 2026
gomarkdown/markdown IsSafeURL panics on short URLs High
CVE-2026-102941 was published for github.com/gomarkdown/markdown (Go) Oct 16, 2026
arpitjain099 Credited to arpitjain099
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses Critical
CVE-2026-102989 was published for @tanstack/react-start (npm) Oct 15, 2026
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation Moderate
CVE-2026-102682 was published for pipecat-ai (pip) Oct 15, 2026
infycore Credited to infycore and agent-kira agent-kira agent-kira
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation Critical
CVE-2026-94603 was published for github.com/containers/podman (Go) Oct 15, 2026
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked Moderate
CVE-2026-102832 was published for jupyterlab (pip) Oct 15, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
SFTPGo source-side file-pattern filter bypass during copy operations Moderate
CVE-2026-103028 was published for github.com/drakkan/sftpgo/v2 (Go) Oct 15, 2026
arpitjain099 Credited to arpitjain099
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning High
CVE-2026-86063 was published for @anthropic-ai/claude-code (npm) Oct 15, 2026
containerd: Unpack DoS via repeated opaque whiteouts Moderate
CVE-2026-95838 was published for github.com/containerd/containerd (Go) Oct 15, 2026
jake-ciolek Credited to jake-ciolek
Distribution: Client `manifests.Get()` does not verify returned content against requested digest Moderate
CVE-2026-85747 was published for github.com/distribution/distribution/v3 (Go) Oct 15, 2026
KrisKennawayDD Credited to KrisKennawayDD
Qwik: Crashing any Qwik Server via Resource thenable High
CVE-2026-84994 was published for @builder.io/qwik (npm) Oct 15, 2026
simonkoeck Credited to simonkoeck
containerd CRI plugin: Checkpoint restore bypasses destination security context High
CVE-2026-95837 was published for github.com/containerd/containerd/v2 (Go) Oct 15, 2026
l2yyd5 Credited to l2yyd5
Backstage: Improper access control in backend action invocation Moderate
CVE-2026-106495 was published for @backstage/backend-defaults (npm) Oct 15, 2026
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter High
CVE-2026-100353 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
eros938 Credited to eros938 and hash3liZer hash3liZer hash3liZer
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database