Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,455
Maven
5,000+
npm
5,000+
NuGet
1,090
pip
5,000+
Pub
13
RubyGems
1,135
Rust
1,509
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

458 advisories

Loading
Incus has an arbitrary file write via path traversal in S3 multipart upload Critical
CVE-2026-48753 was published for github.com/lxc/incus/v7/cmd/incusd (Go) Jun 26, 2026
antifob Credited to antifob and stgraber stgraber stgraber
Incus has arbitrary file read+write on host via templates/ symlink in malicious image Critical
CVE-2026-48752 was published for github.com/lxc/incus/v7/cmd/incusd (Go) Jun 26, 2026
antifob Credited to antifob and stgraber stgraber stgraber
Incus has an arbitrary file write on host via `exec-output` symlink in crafted image Critical
CVE-2026-48750 was published for github.com/lxc/incus/v7/cmd/incusd (Go) Jun 26, 2026
antifob Credited to antifob and stgraber stgraber stgraber
Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image Critical
CVE-2026-48749 was published for github.com/lxc/incus/v7/cmd/incusd (Go) Jun 26, 2026
antifob Credited to antifob and stgraber stgraber stgraber
Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access... Critical Unreviewed
CVE-2025-71334 was published Jun 26, 2026
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process... Critical Unreviewed
CVE-2025-71338 was published Jun 26, 2026
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the... High Unreviewed
CVE-2025-71324 was published Jun 26, 2026
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api... Critical Unreviewed
CVE-2025-71333 was published Jun 26, 2026
OctoPrint has possible file exfiltration via query parameters on upload endpoints High
CVE-2026-54134 was published for OctoPrint (pip) Jun 23, 2026
seankohjs Credited to seankohjs and jacopotediosi jacopotediosi jacopotediosi
Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning High
GHSA-2fmp-9rvw-hc96 was published for network-ai (npm) Jun 19, 2026
sondt99 Credited to sondt99
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project... High Unreviewed
CVE-2026-53915 was published Jun 19, 2026
Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind Moderate
GHSA-2h46-9x5w-4wf7 was published for github.com/entireio/cli (Go) Jun 19, 2026
nskath Credited to nskath
The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is... Moderate Unreviewed
CVE-2026-8118 was published Jun 19, 2026
Armeria: External Control of File Name or Path in xDS SDS DataSource Moderate
CVE-2026-11752 was published for com.linecorp.armeria:armeria-xds (Maven) Jun 18, 2026
zzoru Credited to zzoru
BBOT: Arbitrary File Write in postman_download Module Moderate
CVE-2026-12568 was published for bbot (pip) Jun 18, 2026
nedlir Credited to nedlir
Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message High
GHSA-p6gq-j5cr-w38f was published for nodemailer (npm) Jun 18, 2026
Pig-Tail Credited to Pig-Tail
PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion High
CVE-2026-57113 was published for praisonai (pip) Jun 18, 2026
rexpository Credited to rexpository
A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file... Moderate Unreviewed
CVE-2026-2604 was published Jun 17, 2026
In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was... High Unreviewed
CVE-2026-10303 was published Jun 16, 2026
Langflow: Unauthenticated Shareable Playground arbitrary local or S3 file read Moderate
CVE-2026-48520 was published for langflow (pip) Jun 16, 2026
vbCrLf Credited to vbCrLf, keval718, and andifilhohub keval718 keval718
andifilhohub andifilhohub
An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the... Critical Unreviewed
CVE-2026-39006 was published Jun 15, 2026
launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows Moderate
CVE-2026-53632 was published for launch-editor (npm) Jun 15, 2026
RubenHoms Credited to RubenHoms, toxyl, and bluwy toxyl toxyl
bluwy bluwy
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently... Moderate Unreviewed
CVE-2026-34030 was published Jun 15, 2026
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open()... Critical Unreviewed
CVE-2026-11526 was published Jun 14, 2026
Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite... High Unreviewed
CVE-2026-11527 was published Jun 14, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database