Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,143
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

6,578 advisories

Loading
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled Moderate
CVE-2026-107842 was published for contao/core-bundle (Composer) Oct 9, 2026
iRevivalx Credited to iRevivalx
Contao: The registration module re-sends activation mails Moderate
CVE-2026-107843 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Cross-site request forgery in custom backend actions Low
CVE-2026-107848 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Path traversal in the images controller Moderate
CVE-2026-107844 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Cross-site scripting in the comments bundle Critical
CVE-2026-107845 was published for contao/comments-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Improper access control in the preview links module Moderate
CVE-2026-107850 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
Contao: Improper access control in the table access voter Moderate
CVE-2026-107851 was published for contao/core-bundle (Composer) Oct 9, 2026
sven-jaeger-git Credited to sven-jaeger-git
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision Moderate
CVE-2026-107380 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
ExPatch-LLC Credited to ExPatch-LLC
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences Moderate
CVE-2026-107381 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
arpitjain099 Credited to arpitjain099
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash Moderate
CVE-2026-107379 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
ExPatch-LLC Credited to ExPatch-LLC
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution High
CVE-2026-104890 was published for kunstmaan/bundles-cms (Composer) Oct 7, 2026
N0fl0w Credited to N0fl0w and acrobat acrobat acrobat
Filament: Multi-factor authentication (app) management actions do not require password reauthentication Moderate
CVE-2026-104181 was published for filament/filament (Composer) Oct 5, 2026
Yezper Credited to Yezper and danharrin danharrin danharrin
MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs Moderate
CVE-2026-88023 was published for mongodb/mongodb (Composer) Oct 5, 2026
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path Moderate
CVE-2026-59944 was published for composer/composer (Composer) Oct 2, 2026
DavidCarliez Credited to DavidCarliez, manus-use, and arpitjain099 manus-use manus-use
arpitjain099 arpitjain099
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal Moderate
GHSA-97jj-33gv-5xf9 was published for league/commonmark (Composer) Sep 30, 2026
4n86rakam1 Credited to 4n86rakam1
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan High
GHSA-3q6v-r5mr-hxv8 was published for league/commonmark (Composer) Sep 30, 2026
manus-pi Credited to manus-pi
Laravel: XSS in Debug Page Information Low
CVE-2026-102279 was published for laravel/framework (Composer) Sep 29, 2026
Rikuxx0 Credited to Rikuxx0
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter Low
CVE-2026-102601 was published for league/flysystem (Composer) Sep 29, 2026
iaohkut Credited to iaohkut and Unifex Unifex Unifex
PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey() High
CVE-2026-65954 was published for phpcsstandards/phpcsutils (Composer) Sep 29, 2026
rodrigoprimo Credited to rodrigoprimo, FORIMOC, edorian, and jrfnl FORIMOC FORIMOC
edorian edorian jrfnl jrfnl
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider Critical
CVE-2026-92161 was published for fof/oauth (Composer) Sep 25, 2026
faran1512 Credited to faran1512
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled High
CVE-2026-57440 was published for starcitizenwiki/embedvideo (Composer) Sep 25, 2026
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute High
CVE-2026-61823 was published for code16/sharp (Composer) Sep 25, 2026
nova-aryan Credited to nova-aryan
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass High
CVE-2026-61825 was published for code16/sharp (Composer) Sep 25, 2026
nova-aryan Credited to nova-aryan
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module Low
CVE-2026-57232 was published for contao/contao (Composer) Sep 24, 2026
Para213 Credited to Para213
zbateson/mail-mime-parser has CRLF header injection via attachment filename High
CVE-2026-61815 was published for zbateson/mail-mime-parser (Composer) Sep 24, 2026
iliaal Credited to iliaal
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database