Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

809 advisories

Loading
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability... High Unreviewed
CVE-2026-118377 was published Oct 28, 2026
better-auth: OAuth Proxy lets an attacker sign in as another user High
GHSA-r4xp-prcw-77qf was published for better-auth (npm) Oct 27, 2026
iabdullah215 Credited to iabdullah215 and martinfrancois martinfrancois martinfrancois
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key High
CVE-2026-114612 was published for litellm (pip) Oct 27, 2026
Haruna38 Credited to Haruna38
In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key... Moderate Unreviewed
CVE-2026-115408 was published Oct 27, 2026
A security vulnerability has been detected in DAMO Academy VideoLLaMA2 up to 1.1. Affected by... Low Unreviewed
CVE-2026-116608 was published Oct 27, 2026
A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d.... Moderate Unreviewed
CVE-2026-116254 was published Oct 26, 2026
The Eurobank WooCommerce Payment Gateway WordPress plugin through 2.1.1 does not verify that a... Moderate Unreviewed
CVE-2026-103300 was published Oct 26, 2026
A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown... High Unreviewed
CVE-2026-116116 was published Oct 26, 2026
The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's... Low Unreviewed
CVE-2026-115183 was published Oct 25, 2026
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never... High Unreviewed
CVE-2026-115937 was published Oct 24, 2026
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For Moderate
CVE-2026-114437 was published for github.com/go-chi/chi/v5 (Go) Oct 23, 2026
tenbbughunters Credited to tenbbughunters
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine Moderate
CVE-2026-114050 was published for vllm (pip) Oct 23, 2026
C1ves Credited to C1ves, JSGforever, and jperezdealgaba JSGforever JSGforever
jperezdealgaba jperezdealgaba
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin Moderate
CVE-2026-62204 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 23, 2026
alham-rizvi Credited to alham-rizvi
The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag... Low Unreviewed
CVE-2026-110510 was published Oct 23, 2026
The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that... Moderate Unreviewed
CVE-2026-105256 was published Oct 21, 2026
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of... Moderate Unreviewed
CVE-2026-103301 was published Oct 21, 2026
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment... Moderate Unreviewed
CVE-2026-104641 was published Oct 21, 2026
The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices... Low Unreviewed
CVE-2026-104642 was published Oct 21, 2026
Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization High
GHSA-hfwf-hgvp-4rr8 was published for vllm (pip) Oct 21, 2026 • withdrawn
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics ... Moderate Unreviewed
CVE-2026-91588 was published Oct 21, 2026
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System)... Low Unreviewed
CVE-2026-87414 was published Oct 21, 2026
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to... High Unreviewed
CVE-2026-43835 was published Oct 20, 2026
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows... High Unreviewed
CVE-2026-112265 was published Oct 19, 2026
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The... Low Unreviewed
CVE-2026-112101 was published Oct 19, 2026
The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a... Moderate Unreviewed
CVE-2026-86791 was published Oct 19, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database