Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,506
Maven
5,000+
npm
5,000+
NuGet
1,091
pip
5,000+
Pub
13
RubyGems
1,144
Rust
1,511
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

34,275 advisories

Loading
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts Moderate
GHSA-957r-qf9p-67xw was published for craftcms/cms (Composer) Aug 6, 2026
je-lv Credited to je-lv
h2: Duplicate Host header could facilitate request smuggling Moderate
CVE-2026-71554 was published for h2 (pip) Aug 6, 2026
SunandM Credited to SunandM
Craft CMS: Authenticated leak of secret environment variables Moderate
GHSA-596p-6jv8-775v was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics Moderate
GHSA-rvmm-v933-jgxq was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Incorrect path validation could potentially lead to path traversal Low
GHSA-7hxc-f267-h5q7 was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Stored XSS in the control panel via unescaped draft name Moderate
GHSA-2rp4-x2j7-qmcc was published for craftcms/cms (Composer) Aug 6, 2026
je-lv Credited to je-lv
PHP_CodeSniffer gitblame report command injection via crafted filename High
CVE-2026-67434 was published for squizlabs/php_codesniffer (Composer) Aug 6, 2026
Faze-up Credited to Faze-up, edorian, rodrigoprimo, and jrfnl edorian edorian
rodrigoprimo rodrigoprimo jrfnl jrfnl
node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memory disclosed to JavaScript Moderate
CVE-2026-71498 was published for re2 (npm) Aug 6, 2026
OvOhao Credited to OvOhao
node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result exceeds V8's max string length Moderate
CVE-2026-71430 was published for re2 (npm) Aug 6, 2026
ataberk-xyz Credited to ataberk-xyz
ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633 High
GHSA-w9hm-4m3m-fxmm was published for ngx-extended-pdf-viewer (npm) Aug 6, 2026
calixteman Credited to calixteman
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF High
CVE-2026-16633 was published for pdfjs-dist (npm) Aug 6, 2026
wlayzz Credited to wlayzz
jsoup: Cleaner may expose markup with custom raw-text elements Moderate
CVE-2026-71497 was published for org.jsoup:jsoup (Maven) Aug 6, 2026
quitbug Credited to quitbug and jhy jhy jhy
Craft CMS: Arbitrary user password reset leading to administrator account takeover High
GHSA-p8x7-9vfw-p7vc was published for craftcms/cms (Composer) Aug 6, 2026
mHe4am Credited to mHe4am
Craft CMS: Authenticated RCE through Twig sandbox escape High
GHSA-f5wm-88jv-g5hx was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets Moderate
CVE-2026-14793 was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass High
GHSA-265m-7826-wjqm was published for craftcms/cms (Composer) Aug 6, 2026
saladin0x1 Credited to saladin0x1
league/commonmark: Denial of service via deeply nested XML output Moderate
GHSA-mj63-m3rc-8ppr was published for league/commonmark (Composer) Aug 6, 2026
GrahamCampbell Credited to GrahamCampbell
league/commonmark: Denial of service via colliding heading slugs High
GHSA-mh25-x5hq-wrqp was published for league/commonmark (Composer) Aug 6, 2026
GrahamCampbell Credited to GrahamCampbell
league/commonmark: Denial of service via duplicate footnote definitions High
GHSA-jfm3-95jq-q3rf was published for league/commonmark (Composer) Aug 6, 2026
GrahamCampbell Credited to GrahamCampbell
league/commonmark: Denial of service via adjacent inline attribute blocks High
GHSA-g2gp-3wwq-f4ph was published for league/commonmark (Composer) Aug 6, 2026
GrahamCampbell Credited to GrahamCampbell
league/commonmark: Quadratic-time denial of service when parsing crafted Markdown High
CVE-2026-71488 was published for league/commonmark (Composer) Aug 6, 2026
GrahamCampbell Credited to GrahamCampbell
league/commonmark: AttributesExtension href/src unsafe-link filter bypass via embedded control bytes Moderate
CVE-2026-71478 was published for league/commonmark (Composer) Aug 6, 2026
TungNGo02 Credited to TungNGo02
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported High
GHSA-5p4m-2wfm-xmqj was published for js-yaml (npm) Aug 6, 2026
0xsharz Credited to 0xsharz
Silverstripe: XSS in breadcrumbs in page list view Moderate
CVE-2026-54717 was published for silverstripe/cms (Composer) Aug 6, 2026
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands Moderate
CVE-2026-18654 was published for awscli (pip) Aug 6, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database