Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
101
GitHub Actions
54
Go
4,297
Maven
5,000+
npm
5,000+
NuGet
1,029
pip
5,000+
Pub
13
RubyGems
1,116
Rust
1,492
Swift
61
Unreviewed advisories
All unreviewed
5,000+

4,408 advisories

Loading
TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished... Moderate Unreviewed
CVE-2026-55962 was published Jun 26, 2026
Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the... Moderate Unreviewed
CVE-2026-11703 was published Jun 26, 2026
A flaw was found in KubeVirt's virt-handler domain notify server. The gRPC handlers for... Moderate Unreviewed
CVE-2026-13208 was published Jun 24, 2026
A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server... High Unreviewed
CVE-2026-12112 was published Jun 23, 2026
Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API... Moderate Unreviewed
CVE-2026-34917 was published Jun 23, 2026
The XML‑RPC API addUser method has a validation bypass introduced in the fix for CVE‑2025‑55129.... Low Unreviewed
CVE-2026-44961 was published Jun 23, 2026
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus,... Critical Unreviewed
CVE-2026-11374 was published Jun 23, 2026
motionEye: Authentication possible via password hash Critical
CVE-2026-46488 was published for motioneye (pip) Jun 22, 2026
FireByteApplications Credited to FireByteApplications, 0xLynk, dimashn04, C4spr0x1A, sighnwaive, MichaIng, Marijn0, and zagrim 0xLynk 0xLynk
dimashn04 dimashn04 C4spr0x1A C4spr0x1A sighnwaive sighnwaive MichaIng MichaIng Marijn0 Marijn0 zagrim zagrim
Paymenter doesn't reset email verification status after email change Moderate
CVE-2026-44584 was published for paymenter/paymenter (Composer) Jun 22, 2026
ljskatt Credited to ljskatt and CorwinDev CorwinDev CorwinDev
IBM Langflow OSS 1.0.0 through 1.8.4 could allow unauthenticated attackers to access protected... Critical Unreviewed
CVE-2026-7664 was published Jun 22, 2026
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass... High Unreviewed
CVE-2026-10845 was published Jun 22, 2026
A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json... Moderate Unreviewed
CVE-2026-12795 was published Jun 21, 2026
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function... Moderate Unreviewed
CVE-2026-12773 was published Jun 21, 2026
AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's... Critical Unreviewed
CVE-2026-56345 was published Jun 20, 2026
capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where... Moderate Unreviewed
CVE-2026-56294 was published Jun 20, 2026
Capgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin... Moderate Unreviewed
CVE-2026-56080 was published Jun 20, 2026
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate... Critical Unreviewed
CVE-2026-45480 was published Jun 19, 2026
CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced High
CVE-2026-54781 was published for CoreWCF.Primitives (NuGet) Jun 19, 2026
Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a... Moderate Unreviewed
CVE-2026-49872 was published Jun 19, 2026
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset Moderate
CVE-2026-55689 was published for github.com/openfga/openfga (Go) Jun 19, 2026
0xVijay Credited to 0xVijay
Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges... High Unreviewed
CVE-2026-32174 was published Jun 19, 2026
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) Critical
CVE-2026-11717 was published for github.com/googleapis/mcp-toolbox (Go) Jun 18, 2026
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken) Critical
CVE-2026-11718 was published for github.com/googleapis/mcp-toolbox (Go) Jun 18, 2026
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication High
GHSA-8ccj-p46r-jwqq was published for praisonai (pip) Jun 18, 2026
lc13n Credited to lc13n
praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) Critical
GHSA-f38v-77qj-h4jq was published for praisonai-platform (pip) Jun 18, 2026
Yanchon918s Credited to Yanchon918s
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database