Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,847
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,158
Rust
1,579
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,513
Rust
20

70 advisories

Loading
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's... Critical Unreviewed
CVE-2026-76186 was published Sep 16, 2026
Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin Moderate
CVE-2026-69215 was published for org.http4s:http4s-client_2.12 (Maven) Sep 15, 2026
rossabaker Credited to rossabaker, ERobertGII, and samspills ERobertGII ERobertGII
samspills samspills
Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain Moderate
CVE-2026-69214 was published for org.http4s:http4s-client_2.12 (Maven) Sep 15, 2026
rossabaker Credited to rossabaker, samspills, and morgen-peschke samspills samspills
morgen-peschke morgen-peschke
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side... Critical Unreviewed
CVE-2026-85181 was published Sep 3, 2026
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the... High Unreviewed
CVE-2026-53871 was published Jun 17, 2026
Concrete CMS is vulnerable to IDOR in surveys Moderate
CVE-2026-8337 was published for concrete5/concrete5 (Composer) May 22, 2026
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto... Moderate Unreviewed
CVE-2026-0257 was published May 13, 2026
Serendipity has a Host Header Injection allows authentication cookie scoping to attacker-controlled domain in functions_config.inc.php Moderate
CVE-2026-39963 was published for s9y/serendipity (Composer) Apr 14, 2026
mabjr33 Credited to mabjr33
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization Critical
CVE-2026-39324 was published for rack-session (RubyGems) Apr 8, 2026
sm1ee Credited to sm1ee, ioquatix, and jeremyevans ioquatix ioquatix
jeremyevans jeremyevans
The Debugger & Troubleshooter plugin for WordPress was vulnerable to Unauthenticated Privilege... High Unreviewed
CVE-2026-5130 was published Mar 31, 2026
Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. ... Critical Unreviewed
CVE-2014-125112 was published Mar 26, 2026
Liman 0.7 contains a cross-site request forgery vulnerability that allows attackers to manipulate... Moderate Unreviewed
CVE-2020-37007 was published Jan 29, 2026
WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that... High Unreviewed
CVE-2022-50926 was published Jan 14, 2026
An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The... Critical Unreviewed
CVE-2025-65212 was published Jan 6, 2026
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions... Critical Unreviewed
CVE-2025-14440 was published Dec 13, 2025
COMMAX Biometric Access Control System 1.0.0 contains an authentication bypass vulnerability that... High Unreviewed
CVE-2021-47706 was published Dec 9, 2025
A reliance on cookies without validation and integrity checking vulnerability in Fortinet... High Unreviewed
CVE-2025-64447 was published Dec 9, 2025
In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the ... Moderate Unreviewed
CVE-2025-48980 was published Oct 31, 2025
An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a... High Unreviewed
CVE-2024-55211 was published Apr 17, 2025
The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing... Critical Unreviewed
CVE-2025-2395 was published Mar 17, 2025
The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote... High Unreviewed
CVE-2024-9970 was published Oct 15, 2024
The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass... Moderate Unreviewed
CVE-2024-9820 was published Oct 15, 2024
github.com/gitpod-io/gitpod vulnerable to Cookie Tossing Moderate
CVE-2024-21583 was published for github.com/gitpod-io/gitpod (Go) Jul 19, 2024
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on... Moderate Unreviewed
CVE-2024-39734 was published Jul 14, 2024
Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics... Critical Unreviewed
CVE-2024-0947 was published Jun 27, 2024
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database