Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,556
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,518
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

734 advisories

Loading
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to... Moderate Unreviewed
CVE-2026-10723 was published Jul 22, 2026
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write Critical
CVE-2026-58426 was published for code.gitea.io/gitea (Go) Jul 21, 2026
kamil-sawicki Credited to kamil-sawicki
Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability High
CVE-2026-47304 was published for System.Security.Cryptography.Xml (NuGet) Jul 20, 2026
rbhanda Credited to rbhanda
Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability... High Unreviewed
CVE-2026-64623 was published Jul 20, 2026
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass... Critical Unreviewed
CVE-2026-15013 was published Jul 16, 2026
A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications... Critical Unreviewed
CVE-2026-56451 was published Jul 14, 2026
The firmware update mechanism does not include cryptographic signature validation. This allows... Critical Unreviewed
CVE-2026-22097 was published Jul 13, 2026
sigstore-go has a multi-log threshold bypass via single compromised log Moderate
CVE-2026-49834 was published for github.com/sigstore/sigstore-go (Go) Jul 9, 2026
YesWiki Vulnerable to Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)` High
CVE-2026-52767 was published for yeswiki/yeswiki (Composer) Jul 9, 2026
hash3liZer Credited to hash3liZer and eros938 eros938 eros938
The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Payment Bypass... Moderate Unreviewed
CVE-2026-9027 was published Jul 9, 2026
Improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows... High Unreviewed
CVE-2026-11348 was published Jul 7, 2026
WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via... High Unreviewed
CVE-2026-13722 was published Jul 3, 2026
Libreswan, via the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa(), did not correctly... High Unreviewed
CVE-2026-50722 was published Jul 3, 2026
Libreswan, via the function RSA_authenticate_hash_signature_raw_rsa(), did not correctly verify... High Unreviewed
CVE-2026-50721 was published Jul 3, 2026
CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 are vulnerable to an Improper... Low Unreviewed
CVE-2026-13743 was published Jul 2, 2026
Centrifugo's dynamic JWKS key cache keyed only by `kid` allows cross-issuer JWT authentication bypass High
CVE-2026-49998 was published for github.com/centrifugal/centrifugo (Go) Jul 1, 2026
sondt99 Credited to sondt99
sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced High
CVE-2026-48815 was published for sigstore (npm) Jul 1, 2026
Jvr2022 Credited to Jvr2022, Str1ckl4nd, and Zyy0530 Str1ckl4nd Str1ckl4nd
Zyy0530 Zyy0530
Sigstore Java has a vulnerability with bundle verification of integratedTime Low
CVE-2026-48791 was published for dev.sigstore:sigstore-java (Maven) Jun 30, 2026
Lack of validation for firmware update in Hitachi Hitachi Virtual Storage Platform One Block 23,... Low Unreviewed
CVE-2025-0824 was published Jun 29, 2026
The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially malicious... Moderate Unreviewed
CVE-2024-23581 was published Jun 26, 2026
Relyra SAML SignatureValue not cryptographically verified -> authentication bypass Critical
CVE-2026-49454 was published for relyra (Erlang) Jun 26, 2026
@sigstore/core has DSSE payloadType type-binding failure Moderate
CVE-2026-48758 was published for @sigstore/core (npm) Jun 26, 2026
Str1ckl4nd Credited to Str1ckl4nd and Zyy0530 Zyy0530 Zyy0530
PKCS#12 MAC verification uses an attacker-controlled comparison length, weakening the integrity... Moderate Unreviewed
CVE-2026-6329 was published Jun 26, 2026
PKCS7_verify signer confusion allows forged signatures, where the signer associated with a... Moderate Unreviewed
CVE-2026-7511 was published Jun 26, 2026
HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted... Low Unreviewed
CVE-2026-6331 was published Jun 26, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database