Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,455
Maven
5,000+
npm
5,000+
NuGet
1,090
pip
5,000+
Pub
13
RubyGems
1,135
Rust
1,509
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

1,105 advisories

Loading
Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation Moderate
CVE-2026-52822 was published for kimai/kimai (Composer) Jul 14, 2026
Mitchell45 Credited to Mitchell45
Decidim: CSV census record endpoints improper authorization Moderate
CVE-2026-45415 was published for decidim-verifications (RubyGems) Jul 13, 2026
A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5... Low Unreviewed
CVE-2026-15516 was published Jul 13, 2026
Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO... High Unreviewed
CVE-2026-56313 was published Jul 12, 2026
Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin... High Unreviewed
CVE-2026-56241 was published Jul 12, 2026
Capgo before 12.128.12 contains a billing authorization bypass vulnerability in the plan_valid... Moderate Unreviewed
CVE-2026-56240 was published Jul 11, 2026
tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies Moderate
CVE-2026-49977 was published for tarteaucitronjs (npm) Jul 10, 2026
Rudloff Credited to Rudloff
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some... Low Unreviewed
CVE-2026-15318 was published Jul 10, 2026
A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code... Low Unreviewed
CVE-2026-15191 was published Jul 9, 2026
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books Moderate
CVE-2026-50554 was published for github.com/enchant97/note-mark/backend (Go) Jul 9, 2026
Yunkaiwjs Credited to Yunkaiwjs and enchant97 enchant97 enchant97
NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries Moderate
CVE-2026-49463 was published for nl.nl-portal:besluiten (Maven) Jul 8, 2026
A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function... Low Unreviewed
CVE-2026-15036 was published Jul 8, 2026
Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update... Moderate Unreviewed
CVE-2026-56293 was published Jul 8, 2026
Capgo before 12.128.2 contains a broken access control vulnerability in the organization... High Unreviewed
CVE-2026-56246 was published Jul 8, 2026
@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators Moderate
GHSA-p2fr-6hmx-4528 was published for @better-auth/oauth-provider (npm) Jul 7, 2026
dvanmali Credited to dvanmali
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator High
CVE-2026-55428 was published for github.com/coder/coder/v2 (Go) Jul 6, 2026
Coder: User-admin role can reset owner account password High
CVE-2026-55077 was published for github.com/coder/coder/v2 (Go) Jul 6, 2026
A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function... Moderate Unreviewed
CVE-2026-14793 was published Jul 6, 2026
A vulnerability was detected in mjperpinosa stumasy up to... Moderate Unreviewed
CVE-2026-14753 was published Jul 5, 2026
A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.13.0-beta.2.... Low Unreviewed
CVE-2026-14716 was published Jul 5, 2026
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to... High Unreviewed
CVE-2026-58284 was published Jul 3, 2026
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to... High Unreviewed
CVE-2026-57983 was published Jul 3, 2026
A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI... Low Unreviewed
CVE-2026-14608 was published Jul 3, 2026
Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission Moderate
CVE-2026-50201 was published for Steeltoe.Management.Endpoint (NuGet) Jul 2, 2026
Froxlor customer can create MySQL databases on disallowed servers via Mysqls.add API Moderate
GHSA-q4rm-m6xh-5pv7 was published for froxlor/froxlor (Composer) Jul 2, 2026
offset Credited to offset
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database