Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,455
Maven
5,000+
npm
5,000+
NuGet
1,090
pip
5,000+
Pub
13
RubyGems
1,135
Rust
1,509
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

1,381 advisories

Loading
A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function... Moderate Unreviewed
CVE-2026-15330 was published Jul 10, 2026
A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables... Moderate Unreviewed
CVE-2026-0285 was published Jul 9, 2026
A security vulnerability has been detected in aerostackdev aerostack-mcp up to... Moderate Unreviewed
CVE-2026-15189 was published Jul 9, 2026
pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs Moderate
CVE-2026-48737 was published for pyload-ng (pip) Jul 9, 2026
tonghuaroot Credited to tonghuaroot
Weblate SSRF: outbound URL guard misses some private ranges Moderate
CVE-2026-50127 was published for weblate (pip) Jul 7, 2026
tonghuaroot Credited to tonghuaroot and nijel nijel nijel
oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read) Moderate
CVE-2026-53508 was published for github.com/oasdiff/oasdiff (Go) Jul 7, 2026
NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest... Moderate Unreviewed
CVE-2026-58468 was published Jul 7, 2026
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060) Moderate
CVE-2026-53509 was published for @aborruso/ckan-mcp-server (npm) Jul 7, 2026
hibrian827 Credited to hibrian827
Open WebUI has Blind Server Side Request Forgery in its Image Edit Functionality Moderate
CVE-2026-34225 was published for open-webui (pip) Jul 7, 2026
gg0h Credited to gg0h
Dragonfly scheduler v1 and v2 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile Moderate
CVE-2026-54637 was published for d7y.io/dragonfly/v2 (Go) Jul 6, 2026
tonghuaroot Credited to tonghuaroot and gaius-qi gaius-qi gaius-qi
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized... Moderate Unreviewed
CVE-2026-58278 was published Jul 3, 2026
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized... Moderate Unreviewed
CVE-2026-57987 was published Jul 3, 2026
The WP Import Export Lite plugin for WordPress is vulnerable to Server-Side Request Forgery in... Moderate Unreviewed
CVE-2026-11397 was published Jul 3, 2026
AutoBangumi before 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows... Moderate Unreviewed
CVE-2026-59101 was published Jul 2, 2026
Mautic Focus component Vulnerable to SSRF Moderate
CVE-2026-9557 was published for mautic/core (Composer) Jul 2, 2026
r1beirin Credited to r1beirin, patrykgruszka, dungNHVhust, escopecz, and Mitchell45 patrykgruszka patrykgruszka
dungNHVhust dungNHVhust escopecz escopecz Mitchell45 Mitchell45
@asymmetric-effort/specifyjs: No redirect target validation in secureFetch Moderate
GHSA-j5qp-p44g-2m49 was published for @asymmetric-effort/specifyjs (npm) Jul 2, 2026
@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction Moderate
GHSA-2944-57xv-2682 was published for @asymmetric-effort/specifyjs (npm) Jul 2, 2026
@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range) Moderate
GHSA-xw57-23p8-9wc5 was published for @asymmetric-effort/specifyjs (npm) Jul 2, 2026
OpenClaw's browser act interactions could bypass private-network navigation checks Moderate
CVE-2026-53812 was published for openclaw (npm) Jul 2, 2026
cantinagen Credited to cantinagen and Ellahinator Ellahinator Ellahinator
Subscriber Server Side Request Forgery (SSRF) in GeoDirectory <= 2.8.161 versions. Moderate Unreviewed
CVE-2026-57681 was published Jul 2, 2026
liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve()... Moderate Unreviewed
CVE-2026-54430 was published Jul 2, 2026
Rancher Fleet has SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml Moderate
CVE-2026-44936 was published for github.com/rancher/fleet (Go) Jul 1, 2026
SurrealDB: Port-specific --deny-net rules silently bypassed on HTTP redirect Moderate
GHSA-97vg-427p-8hx5 was published for surrealdb (Rust) Jul 1, 2026
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization Moderate
CVE-2026-49856 was published for @jshookmcp/jshook (npm) Jul 1, 2026
DavidCarliez Credited to DavidCarliez
Open WebUI before 0.6.27 contains a server-side request forgery vulnerability in the /api/v1... Moderate Unreviewed
CVE-2026-56399 was published Jul 1, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database