Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
64
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,232
pip
5,000+
Pub
14
RubyGems
1,186
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,591
Rust
23

37,742 advisories

Loading
Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server Moderate
CVE-2026-88985 was published for github.com/kubeflow/pipelines (Go) Nov 9, 2026
phisch1991 Credited to phisch1991 and k0rti k0rti k0rti
Kiwi TCMS account confirmation open redirect through protocol-relative URLs Moderate
CVE-2026-77433 was published for kiwitcms (pip) Nov 9, 2026
theyoge Credited to theyoge
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines High
CVE-2026-88984 was published for github.com/kubeflow/pipelines (Go) Nov 9, 2026
brodmart Credited to brodmart
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation Moderate
CVE-2026-88983 was published for github.com/kubeflow/pipelines (Go) Nov 9, 2026
gasbugs Credited to gasbugs
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) Moderate
CVE-2026-88982 was published for github.com/kubeflow/pipelines (Go) Nov 9, 2026
VitoCrl Credited to VitoCrl
Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace High
CVE-2026-88968 was published for @anthropic-ai/claude-code (npm) Nov 9, 2026
croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive Moderate
CVE-2026-119298 was published for github.com/schollz/croc (Go) Nov 9, 2026
Reload3d Credited to Reload3d
DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885 High
CVE-2026-108262 was published for github.com/ddev/ddev (Go) Nov 9, 2026
arpitjain099 Credited to arpitjain099
Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser High
CVE-2026-97705 was published for moleculer (npm) Nov 9, 2026
tinyb0y Credited to tinyb0y
Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin Moderate
CVE-2026-85737 was published for www.velocidex.com/golang/velociraptor (Go) Nov 9, 2026
kah-ja Credited to kah-ja
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads Critical
CVE-2026-77596 was published for github.com/kubeflow/pipelines (Go) Nov 9, 2026
VitoCrl Credited to VitoCrl
FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files Moderate
CVE-2026-94619 was published for filegator/filegator (Composer) Nov 9, 2026
Yunnn-Yulio Credited to Yunnn-Yulio and alcalbg alcalbg alcalbg
FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive Moderate
CVE-2026-94618 was published for filegator/filegator (Composer) Nov 9, 2026
Yunnn-Yulio Credited to Yunnn-Yulio and alcalbg alcalbg alcalbg
Code Graph RAG structural tools follow out-of-root symlinks High
CVE-2026-87008 was published for code-graph-rag (pip) Nov 9, 2026
squeeze440 Credited to squeeze440
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin Critical
CVE-2026-102895 was published for gpustack (pip) Nov 9, 2026
nikkoenggaliano Credited to nikkoenggaliano and Shadowoyz Shadowoyz Shadowoyz
Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing Critical
CVE-2026-115770 was published for github.com/pocket-id/pocket-id/backend (Go) Nov 9, 2026
nexicturbo Credited to nexicturbo
Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS) Moderate
CVE-2026-103022 was published for urwid (pip) Nov 9, 2026
SunandM Credited to SunandM
esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal High
CVE-2026-102657 was published for github.com/esm-dev/esm.sh/web (Go) Nov 9, 2026
sondt99 Credited to sondt99
fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution Moderate
CVE-2026-102610 was published for fast-agent-mcp (pip) Nov 9, 2026
novice-22 Credited to novice-22
Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets High
CVE-2026-102340 was published for github.com/telepresenceio/telepresence (Go) Nov 9, 2026
0xVijay Credited to 0xVijay
Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable High
CVE-2026-102339 was published for github.com/telepresenceio/telepresence/v2 (Go) Nov 9, 2026
0xVijay Credited to 0xVijay
zizmor: Debug logging prints available GitHub credentials in cleartext High
CVE-2026-102289 was published for zizmor (pip) Nov 9, 2026
shaanmajid Credited to shaanmajid and woodruffw woodruffw woodruffw
ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header Moderate
CVE-2026-86041 was published for github.com/mayswind/ezbookkeeping (Go) Nov 9, 2026
Dokaoista Credited to Dokaoista
OmniAuth: Host Header Injection Vulnerability Moderate
CVE-2026-63183 was published for omniauth (RubyGems) Nov 9, 2026
Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization High
CVE-2026-75598 was published for com.gradleup.shadow:com.gradleup.shadow.gradle.plugin (Maven) Nov 9, 2026
ikersl Credited to ikersl
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database