Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
46
GitHub Actions
48
Go
3,343
Maven
5,000+
npm
5,000+
NuGet
881
pip
4,550
Pub
12
RubyGems
1,013
Rust
1,203
Swift
51
Unreviewed advisories
All unreviewed
5,000+

27,945 advisories

Loading
LibreNMS has a Stored XSS in Alert Rule Moderate
CVE-2026-26989 was published for librenms/librenms (Composer) Feb 18, 2026
quirmz Credited to quirmz
LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream. High
CVE-2026-26988 was published for librenms/librenms (Composer) Feb 18, 2026
Snow1nd Credited to Snow1nd
LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags() Moderate
CVE-2026-27016 was published for librenms/librenms (Composer) Feb 18, 2026
decsecre583 Credited to decsecre583
LibreNMS /port-groups name Stored Cross-Site Scripting Moderate
CVE-2026-26992 was published for librenms/librenms (Composer) Feb 18, 2026
wsparks-vc Credited to wsparks-vc and awoffsec awoffsec awoffsec
LibreNMS /device-groups name Stored Cross-Site Scripting Moderate
CVE-2026-26991 was published for librenms/librenms (Composer) Feb 18, 2026
wsparks-vc Credited to wsparks-vc and awoffsec awoffsec awoffsec
LibreNMS affected by reflected xss via email field Moderate
CVE-2026-26987 was published for librenms/librenms (Composer) Feb 18, 2026
Nokogiri does not check the return value from xmlC14NExecute Moderate
GHSA-wx95-c6cv-8532 was published for nokogiri (RubyGems) Feb 18, 2026
Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path High
CVE-2026-26280 was published for systeminformation (npm) Feb 18, 2026
mom3gool Credited to mom3gool
Ghost has a SQL injection in Content API Critical
CVE-2026-26980 was published for ghost (npm) Feb 18, 2026
Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde High
CVE-2026-26974 was published for @tygo-van-den-hurk/slyde (npm) Feb 18, 2026
Tygo-van-den-Hurk Credited to Tygo-van-den-Hurk
mingSoft MCMS does not properly restrict file uploads Low
CVE-2026-2666 was published for net.mingsoft:ms-mcms (Maven) Feb 18, 2026
OpenStack Nova calls qemu-img without format restrictions for resize High
CVE-2026-24708 was published for Nova (pip) Feb 18, 2026
NLTK has a Zip Slip Vulnerability Critical
CVE-2025-14009 was published for nltk (pip) Feb 18, 2026
leegks Credited to leegks and adamlaurencik adamlaurencik adamlaurencik
Picklescan (scan_pytorch) Bypass via dynamic eval MAGIC_NUMBER High
GHSA-97f8-7cmv-76j2 was published for picklescan (pip) Feb 18, 2026
zpbrent Credited to zpbrent
OpenClaw has an authentication bypass in sandbox browser bridge server High
CVE-2026-28468 was published for openclaw (npm) Feb 18, 2026
jackhax Credited to jackhax
OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension High
CVE-2026-28451 was published for openclaw (npm) Feb 18, 2026
zpbrent Credited to zpbrent
OpenClaw has a LFI in BlueBubbles media path handling High
CVE-2026-29611 was published for openclaw (npm) Feb 18, 2026
zpbrent Credited to zpbrent
OpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup Moderate
CVE-2026-27486 was published for openclaw (npm) Feb 18, 2026
aether-ai-agent Credited to aether-ai-agent
OpenClaw Chutes manual OAuth state validation bypass can cause credential substitution Moderate
CVE-2026-28477 was published for openclaw (npm) Feb 18, 2026
OpenClaw: Prevent shell injection in macOS keychain credential write High
CVE-2026-27487 was published for openclaw (npm) Feb 18, 2026
aether-ai-agent Credited to aether-ai-agent
OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes High
CVE-2026-28462 was published for openclaw (npm) Feb 18, 2026
jackhax Credited to jackhax
OpenClaw has a Path Traversal in Browser Download Functionality Moderate
CVE-2026-26972 was published for openclaw (npm) Feb 18, 2026
locus-x64 Credited to locus-x64
Jenkins has a stored XSS vulnerability in node offline cause description High
CVE-2026-27099 was published for org.jenkins-ci.main:jenkins-core (Maven) Feb 18, 2026
Bruceliu-rs Credited to Bruceliu-rs
Jenkins has a build information disclosure vulnerability through Run Parameter Moderate
CVE-2026-27100 was published for org.jenkins-ci.main:jenkins-core (Maven) Feb 18, 2026
Bruceliu-rs Credited to Bruceliu-rs
NVIDIA NeMo Framework Deserializes Untrusted Data High
CVE-2025-33253 was published for nemo-toolkit (pip) Feb 18, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database