Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
44
GitHub Actions
47
Go
3,295
Maven
5,000+
npm
5,000+
NuGet
876
pip
4,524
Pub
12
RubyGems
1,008
Rust
1,194
Swift
51
Unreviewed advisories
All unreviewed
5,000+

1,958 advisories

Loading
PinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrl Moderate
CVE-2026-33619 was published for github.com/pinchtab/pinchtab (Go) Mar 24, 2026
mean3374 Credited to mean3374
A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship... Moderate Unreviewed
CVE-2026-4623 was published Mar 24, 2026
Roadiz has Server-Side Request Forgery (SSRF) in roadiz/documents Moderate
CVE-2026-33486 was published for roadiz/documents (Composer) Mar 23, 2026
ROCmertakdag Credited to ROCmertakdag and ambroisemaupate ambroisemaupate ambroisemaupate
Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin Moderate
CVE-2026-32279 was published for opensource-workshop/connect-cms (Composer) Mar 23, 2026
odgrso Credited to odgrso
A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function... Moderate Unreviewed
CVE-2026-4589 was published Mar 23, 2026
A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function... Moderate Unreviewed
CVE-2026-4528 was published Mar 22, 2026
The Content Syndication Toolkit plugin for WordPress is vulnerable to Server-Side Request Forgery... High Unreviewed
CVE-2026-3478 was published Mar 21, 2026
The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all... High Unreviewed
CVE-2026-1648 was published Mar 21, 2026
The Post Affiliate Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all... Moderate Unreviewed
CVE-2026-2290 was published Mar 21, 2026
The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all... High Unreviewed
CVE-2026-1313 was published Mar 21, 2026
The WowOptin: Next-Gen Popup Maker plugin for WordPress is vulnerable to Server-Side Request... High Unreviewed
CVE-2026-4302 was published Mar 21, 2026
AVideo has Unauthenticated SSRF via plugin/Live/test.php Critical
CVE-2026-33502 was published for wwbn/avideo (Composer) Mar 20, 2026
Ahmad-jarwan Credited to Ahmad-jarwan
PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled Moderate
GHSA-pgx6-7jcq-2qff was published for @pdfme/common (npm) Mar 20, 2026
restriction Credited to restriction
AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy High
CVE-2026-33480 was published for wwbn/avideo (Composer) Mar 20, 2026
restriction Credited to restriction
Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to... Critical Unreviewed
CVE-2026-32169 was published Mar 19, 2026
Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform... Moderate Unreviewed
CVE-2026-26120 was published Mar 19, 2026
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to... High Unreviewed
CVE-2026-26139 was published Mar 19, 2026
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to... High Unreviewed
CVE-2026-26138 was published Mar 19, 2026
Server-side request forgery (ssrf) in Microsoft 365 Copilot's Business Chat allows an authorized... High Unreviewed
CVE-2026-26137 was published Mar 19, 2026
AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass Critical
CVE-2026-33351 was published for wwbn/avideo (Composer) Mar 19, 2026
iconnnjka Credited to iconnnjka
league/commonmark has an embed extension allowed_domains bypass Moderate
CVE-2026-33347 was published for league/commonmark (Composer) Mar 19, 2026
HuajiHD Credited to HuajiHD
The backend database management connection test feature in wgcloud v3.6.3 has a server-side... High Unreviewed
CVE-2026-30404 was published Mar 19, 2026
AVideo Affected by SSRF in BulkEmbed Thumbnail Fetch Allows Reading Internal Network Resources Moderate
CVE-2026-33294 was published for wwbn/avideo (Composer) Mar 19, 2026
restriction Credited to restriction
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request... Moderate Unreviewed
CVE-2025-71258 was published Mar 19, 2026
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request... Moderate Unreviewed
CVE-2025-71259 was published Mar 19, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database