Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,590
Rust
22

37,615 advisories

Loading
Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment Moderate
CVE-2026-77463 was published for github.com/umputun/remark42 (Go) Nov 9, 2026
de3erve-hunter Credited to de3erve-hunter
Pocket ID: The client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences High
CVE-2026-62662 was published for github.com/pocket-id/pocket-id/backend (Go) Nov 9, 2026
duijf Credited to duijf
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients Moderate
CVE-2026-76893 was published for @tsparticles/mcp-server (npm) Nov 9, 2026
NetKingJ Credited to NetKingJ
tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process High
CVE-2026-76892 was published for @tsparticles/mcp-server (npm) Nov 9, 2026
NetKingJ Credited to NetKingJ
JSON-java: JSONTokener Has Unbounded Numeric String Resource-Exhaustion DoS Moderate
CVE-2026-59171 was published for org.json:json (Maven) Nov 9, 2026
waydeshi Credited to waydeshi
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS High
CVE-2026-63655 was published for @tsparticles/mcp-server (npm) Nov 9, 2026
EQSTLab Credited to EQSTLab and min8282 min8282 min8282
ag-psd: Uncontrolled Memory Allocation in PSD Layer Decoding (totalMemoryLimit bypass) High
CVE-2026-63501 was published for ag-psd (npm) Nov 9, 2026
EQSTLab Credited to EQSTLab
zt-zip: ZipUtil.unpack can change file permissions of output directory Moderate
CVE-2026-63499 was published for org.zeroturnaround:zt-zip (Maven) Nov 9, 2026
Marcono1234 Credited to Marcono1234
traQ: Privilege escalation by OAuth prompt=none request High
CVE-2026-63198 was published for github.com/traPtitech/traQ (Go) Nov 9, 2026
mochidukiyukimi-wq Credited to mochidukiyukimi-wq
traQ: XSS in the User Uploaded File Retrieval API High
CVE-2026-63197 was published for github.com/traPtitech/traQ (Go) Nov 9, 2026
mochidukiyukimi-wq Credited to mochidukiyukimi-wq
isomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout Moderate
CVE-2026-63478 was published for isomorphic-git (npm) Nov 9, 2026
spiceoverflow Credited to spiceoverflow
isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS) Moderate
CVE-2026-63475 was published for isomorphic-git (npm) Nov 9, 2026
spiceoverflow Credited to spiceoverflow
isomorphic-git: Arbitrary file write outside of working tree via directory symlink during checkout (potential RCE) High
CVE-2026-63395 was published for isomorphic-git (npm) Nov 9, 2026
spiceoverflow Credited to spiceoverflow
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator Critical
CVE-2026-63471 was published for fastapi-code-generator (pip) Nov 9, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict Critical
CVE-2026-63469 was published for fastapi-code-generator (pip) Nov 9, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring Critical
CVE-2026-63470 was published for fastapi-code-generator (pip) Nov 9, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
zt-zip: Path traversal in fluent API unpack High
CVE-2026-63436 was published for org.zeroturnaround:zt-zip (Maven) Nov 9, 2026
czTangt Credited to czTangt
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted High
CVE-2026-63417 was published for loggingredactor (pip) Nov 9, 2026
LXD has restricted project bypass leading to arbitrary command execution Critical
GHSA-47w9-6r3f-938g was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has project restriction bypass for custom volume copy across projects High
GHSA-7mr3-28h5-m5vx was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
LXD has project restriction bypass in instance copy across projects High
GHSA-qx75-2p3r-pwm5 was published for github.com/canonical/lxd (Go) Nov 6, 2026
antifob Credited to antifob and stgraber stgraber stgraber
GeoNode has Stored XSS in Documents metadata abstract field Moderate
CVE-2026-55649 was published for GeoNode (pip) Nov 6, 2026
GeoNode has Unrestricted File Upload Moderate
CVE-2026-46429 was published for GeoNode (pip) Nov 6, 2026
f00bar10 Credited to f00bar10
GeoNode has OS command injection via uploaded file layer name High
CVE-2026-33050 was published for GeoNode (pip) Nov 6, 2026
ByamB4 Credited to ByamB4
LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at Moderate
CVE-2026-9639 was published for github.com/canonical/lxd (Go) Nov 6, 2026
tonghuaroot Credited to tonghuaroot
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database