Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,535
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,515
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

34,533 advisories

Loading
membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion Moderate
CVE-2026-53423 was published for membrane_mp4_plugin (Erlang) Aug 18, 2026
varsill Credited to varsill, mat-hek, and maennchen mat-hek mat-hek
maennchen maennchen
surfio has an out-of-bounds read Critical
CVE-2026-55211 was published for surfio (pip) Aug 18, 2026
oddmunds Credited to oddmunds
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read Critical
CVE-2026-55209 was published for resdata (pip) Aug 18, 2026
oddmunds Credited to oddmunds
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) Critical
CVE-2026-55107 was published for kobako (RubyGems) Aug 18, 2026
alhafoudh Credited to alhafoudh
MeshCentral has unsanitized data fields High
GHSA-c7hr-448w-65px was published for meshcentral (npm) Aug 18, 2026
kevthehermit Credited to kevthehermit
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads Moderate
CVE-2026-68922 was published for mobsf (pip) Aug 18, 2026
Daniel-GrunbergerCA Credited to Daniel-GrunbergerCA
MobSF's CSRF checks not enforced after Django migration Moderate
CVE-2026-68923 was published for mobsf (pip) Aug 18, 2026
ya3raj Credited to ya3raj
MobSF has SSRF port restriction bypass in assetlinks_check Low
CVE-2026-68927 was published for mobsf (pip) Aug 18, 2026
DavidCarliez Credited to DavidCarliez
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction Moderate
CVE-2026-68924 was published for mobsf (pip) Aug 18, 2026
ya3raj Credited to ya3raj
MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables Moderate
CVE-2026-63640 was published for magicmirror (npm) Aug 18, 2026
sondt99 Credited to sondt99
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data High
CVE-2026-55178 was published for @geolens/sdk (npm) Aug 18, 2026
LibreNMS Vulnerable to Remote Code Execution by Signal Alert Transportation module High
CVE-2026-55182 was published for librenms/librenms (Composer) Aug 18, 2026
YuriNek0 Credited to YuriNek0
MagicMirror: ssrf calendar .js Moderate
CVE-2026-63643 was published for magicmirror (npm) Aug 18, 2026
gabrie0x6c Credited to gabrie0x6c
MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery Moderate
CVE-2026-63642 was published for magicmirror (npm) Aug 18, 2026
gabrie0x6c Credited to gabrie0x6c
MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions Low
CVE-2026-63641 was published for magicmirror (npm) Aug 18, 2026
sondt99 Credited to sondt99
RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max Low
CVE-2026-61634 was published for com.rabbitmq:amqp-client (Maven) Aug 18, 2026
Alexender676 Credited to Alexender676
RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM Moderate
CVE-2026-63336 was published for com.rabbitmq:amqp-client (Maven) Aug 18, 2026
lucianjohnhouse Credited to lucianjohnhouse
RabbitMQ Java client malformed body frame triggers raw command assembler exception Moderate
CVE-2026-63335 was published for com.rabbitmq:amqp-client (Maven) Aug 18, 2026
hibrian827 Credited to hibrian827
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading High
CVE-2026-63337 was published for com.rabbitmq:amqp-client (Maven) Aug 18, 2026
lucianjohnhouse Credited to lucianjohnhouse
RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation High
CVE-2026-69219 was published for com.rabbitmq:amqp-client (Maven) Aug 18, 2026
lucianjohnhouse Credited to lucianjohnhouse
RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS High
CVE-2026-69220 was published for com.rabbitmq:amqp-client (Maven) Aug 18, 2026
lucianjohnhouse Credited to lucianjohnhouse
Trivy Plugin Manager has Path Traversal that Allows Arbitrary File Write Moderate
CVE-2026-63328 was published for github.com/aquasecurity/trivy (Go) Aug 18, 2026
fatihhcelik Credited to fatihhcelik
Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection High
CVE-2026-55839 was published for io.kestra:kestra (Maven) Aug 18, 2026
5h1kh4r Credited to 5h1kh4r
@rhinostone/swig: arbitrary local file read via include/extends path traversal High
GHSA-2mf3-mr2r-r4vf was published for @rhinostone/swig (npm) Aug 18, 2026
Martin-Luther Credited to Martin-Luther
Copyparty vulnerable to file/dirkey confusion Moderate
CVE-2026-70657 was published for copyparty (pip) Aug 18, 2026
poolcritter Credited to poolcritter
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database