Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,452
Maven
5,000+
npm
5,000+
NuGet
1,090
pip
5,000+
Pub
13
RubyGems
1,134
Rust
1,509
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

1,381 advisories

Loading
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` Moderate
CVE-2026-54663 was published for swagger-typescript-api (npm) Jul 29, 2026
thegr1ffyn Credited to thegr1ffyn
The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the ... Moderate Unreviewed
CVE-2026-6089 was published Jul 29, 2026
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side... Moderate Unreviewed
CVE-2026-4912 was published Jul 28, 2026
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before... Moderate Unreviewed
CVE-2026-67173 was published Jul 28, 2026
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition Moderate
GHSA-vg6v-j97m-h5xq was published for @novu/application-generic (npm) Jul 28, 2026
b-hermes Credited to b-hermes
Improper URL validation when handling specific URLs, allows an attacker, under certain conditions... Moderate Unreviewed
CVE-2026-65618 was published Jul 27, 2026
A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request... Moderate Unreviewed
CVE-2026-65925 was published Jul 27, 2026
A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user,... Moderate Unreviewed
CVE-2026-65923 was published Jul 27, 2026
JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server... Moderate Unreviewed
CVE-2026-65924 was published Jul 27, 2026
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made... Moderate Unreviewed
CVE-2026-17192 was published Jul 27, 2026
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. Moderate Unreviewed
CVE-2026-66437 was published Jul 27, 2026
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions. Moderate Unreviewed
CVE-2026-65558 was published Jul 27, 2026
Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static... Moderate Unreviewed
CVE-2026-17534 was published Jul 27, 2026
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller Moderate
GHSA-8q49-2h5h-434x was published for @frontmcp/adapters (npm) Jul 24, 2026
EchoSkorJjj Credited to EchoSkorJjj and frontegg-david frontegg-david frontegg-david
Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests Moderate
GHSA-v6w6-358x-2433 was published for github.com/cloudreve/Cloudreve/v3 (Go) Jul 24, 2026
DavidCarliez Credited to DavidCarliez
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation Moderate
GHSA-hfhx-w8p8-4hc7 was published for @budibase/server (npm) Jul 24, 2026
oduoke567 Credited to oduoke567
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook... Moderate Unreviewed
CVE-2026-16910 was published Jul 24, 2026
Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions. Moderate Unreviewed
CVE-2026-65496 was published Jul 23, 2026
Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions. Moderate Unreviewed
CVE-2026-65467 was published Jul 23, 2026
Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. Moderate Unreviewed
CVE-2026-65466 was published Jul 23, 2026
Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. Moderate Unreviewed
CVE-2026-24639 was published Jul 23, 2026
n8n: SSRF Protection Bypass via MCP Client Node Moderate
GHSA-vhf8-cg2h-cg3p was published for n8n (npm) Jul 22, 2026
nil340 Credited to nil340
n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access Moderate
CVE-2026-65593 was published for n8n (npm) Jul 22, 2026
al1z4deh Credited to al1z4deh
In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content... Moderate Unreviewed
CVE-2026-13192 was published Jul 22, 2026
Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access Moderate
GHSA-38fj-36m5-783c was published for n8n (npm) Jul 22, 2026 • withdrawn
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database