Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,585
Maven
5,000+
npm
5,000+
NuGet
923
pip
4,817
Pub
13
RubyGems
1,043
Rust
1,251
Swift
53
Unreviewed advisories
All unreviewed
5,000+

94 advisories

Loading
Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI Critical
GHSA-9qhq-v63v-fv3j was published for praisonai (pip) Apr 17, 2026
decsecre583 Credited to decsecre583
aws-mcp has a Command Injection Remote Code Execution Vulnerability Critical
CVE-2026-5059 was published for aws-mcp (pip) Apr 11, 2026
arnewouters Credited to arnewouters
PraisonAI has critical RCE via `type: job` workflow YAML Critical
CVE-2026-40288 was published for PraisonAI (pip) Apr 10, 2026
l3tchupkt Credited to l3tchupkt
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py) Critical
CVE-2026-40111 was published for praisonaiagents (pip) Apr 10, 2026
g0w6y Credited to g0w6y
PraisonAI Vulnerable to OS Command Injection Critical
CVE-2026-40088 was published for PraisonAI (pip) Apr 8, 2026
l3tchupkt Credited to l3tchupkt
pyLoad: Improper Neutralization of Special Elements used in an OS Command High
CVE-2026-35463 was published for pyload-ng (pip) Apr 4, 2026
axel-corsiez Credited to axel-corsiez
BentoML: Command Injection in cloud deployment setup script High
CVE-2026-35043 was published for bentoml (pip) Apr 3, 2026
kodareef5 Credited to kodareef5
PraisonAI Has Sandbox Escape via shell=True and Bypassable Blocklist in SubprocessSandbox High
CVE-2026-34955 was published for praisonai (pip) Apr 1, 2026
YeranG30 Credited to YeranG30
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() Critical
CVE-2026-34935 was published for praisonai (pip) Apr 1, 2026
YeranG30 Credited to YeranG30
PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution High
CVE-2026-34937 was published for praisonaiagents (pip) Apr 1, 2026
YeranG30 Credited to YeranG30
FastMCP has a Command Injection vulnerability - Gemini CLI Moderate
CVE-2025-64340 was published for fastmcp (pip) Mar 31, 2026
nil340 Credited to nil340
Mflow: Command Injection when serving models with enable_mlserver=True Critical
CVE-2026-0596 was published for mflow (pip) Mar 31, 2026
ConnorCallison Credited to ConnorCallison
Glances Vulnerable to Command Injection via Dynamic Configuration Values High
CVE-2026-33641 was published for Glances (pip) Mar 30, 2026
mith36 Credited to mith36
OpenHands is Vulnerable to Command Injection through its Git Diff Handler High
CVE-2026-33718 was published for openhands (pip) Mar 25, 2026
yueyueL Credited to yueyueL and ESPanda666 ESPanda666 ESPanda666
Modoboa has OS Command Injection High
CVE-2026-27602 was published for modoboa (pip) Mar 25, 2026
ByamB4 Credited to ByamB4
Indico discloses local files resulting in Remote Code Execution through LaTeX injection High
CVE-2026-33046 was published for indico (pip) Mar 23, 2026
dreyercito Credited to dreyercito and daw1012345 daw1012345 daw1012345
Intake has a Command Injection via shell() Expansion in Parameter Defaults High
CVE-2026-33310 was published for intake (pip) Mar 19, 2026
redyank Credited to redyank
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver High
CVE-2026-33154 was published for dynaconf (pip) Mar 18, 2026
redyank Credited to redyank
Glances has a Command Injection via Process Names in Action Command Templates High
CVE-2026-32608 was published for Glances (pip) Mar 16, 2026
offset Credited to offset
yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option High
CVE-2026-26331 was published for yt-dlp (pip) Feb 23, 2026
dxlerYT Credited to dxlerYT, Grub4K, and bashonly Grub4K Grub4K
bashonly bashonly
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection Critical
CVE-2026-25130 was published for cai-framework (pip) Jan 30, 2026
FailButWin Credited to FailButWin and 0x5t 0x5t 0x5t
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer High
CVE-2025-62703 was published for fugue (pip) Nov 25, 2025
Chenpinji Credited to Chenpinji
pgAdmin 4 has command injection vulnerability on Windows systems Moderate
CVE-2025-12763 was published for pgadmin4 (pip) Nov 13, 2025
motionEye vulnerable to RCE via unsanitized motion config parameter High
CVE-2025-60787 was published for motioneye (pip) Nov 3, 2025
prabhatverma47 Credited to prabhatverma47 and MichaIng MichaIng MichaIng
Apache Airflow has a command injection vulnerability in "example_dag_decorator" Moderate
CVE-2025-54941 was published for apache-airflow (pip) Oct 30, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database