Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,475
Maven
5,000+
npm
5,000+
NuGet
1,091
pip
5,000+
Pub
13
RubyGems
1,144
Rust
1,511
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

2,777 advisories

Loading
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made... Moderate Unreviewed
CVE-2026-17192 was published Jul 27, 2026
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions. Moderate Unreviewed
CVE-2026-66437 was published Jul 27, 2026
Unauthenticated Server Side Request Forgery (SSRF) in AffiliateX <= 2.3.5 versions. Moderate Unreviewed
CVE-2026-65558 was published Jul 27, 2026
Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer &amp; Embedder <= 1... High Unreviewed
CVE-2026-59552 was published Jul 27, 2026
Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static... Moderate Unreviewed
CVE-2026-17534 was published Jul 27, 2026
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does... High Unreviewed
CVE-2025-15662 was published Jul 27, 2026
A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function... Low Unreviewed
CVE-2026-17458 was published Jul 26, 2026
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller Moderate
GHSA-8q49-2h5h-434x was published for @frontmcp/adapters (npm) Jul 24, 2026
EchoSkorJjj Credited to EchoSkorJjj and frontegg-david frontegg-david frontegg-david
Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests Moderate
GHSA-v6w6-358x-2433 was published for github.com/cloudreve/Cloudreve/v3 (Go) Jul 24, 2026
DavidCarliez Credited to DavidCarliez
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway Critical
GHSA-68r5-9hpg-7qw9 was published for org.openidentityplatform.opendj:opendj-dsml-servlet (Maven) Jul 24, 2026
manus-use Credited to manus-use
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation Moderate
GHSA-hfhx-w8p8-4hc7 was published for @budibase/server (npm) Jul 24, 2026
oduoke567 Credited to oduoke567
Budibase: SSRF via DNS rebinding in the REST datasource integration High
GHSA-v42f-v8xc-j435 was published for @budibase/server (npm) Jul 24, 2026
dhairya7760 Credited to dhairya7760
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution High
GHSA-xg5g-26x8-cvf4 was published for @budibase/server (npm) Jul 24, 2026
DavidCarliez Credited to DavidCarliez
open-webui terminal proxy path traversal guard bypass via 9x encoded traversal High
CVE-2026-59221 was published for open-webui (pip) Jul 24, 2026
DavidCarliez Credited to DavidCarliez and Classic298 Classic298 Classic298
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF High
CVE-2026-59863 was published for Microsoft.OpenApi.Kiota (NuGet) Jul 24, 2026
Gal3m Credited to Gal3m, mrostamipoor, baywet, and gavinbarron mrostamipoor mrostamipoor
baywet baywet gavinbarron gavinbarron
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref High
CVE-2026-59867 was published for Microsoft.OpenApi.Kiota (NuGet) Jul 24, 2026
Gal3m Credited to Gal3m, mrostamipoor, baywet, and gavinbarron mrostamipoor mrostamipoor
baywet baywet gavinbarron gavinbarron
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate... Critical Unreviewed
CVE-2026-57106 was published Jul 24, 2026
A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook... Moderate Unreviewed
CVE-2026-16910 was published Jul 24, 2026
Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate... High Unreviewed
CVE-2026-56167 was published Jul 24, 2026
9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web... High Unreviewed
CVE-2026-63313 was published Jul 24, 2026
Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows... High Unreviewed
CVE-2026-21653 was published Jul 23, 2026
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist High
CVE-2026-59931 was published for phpoffice/phpspreadsheet (Composer) Jul 23, 2026
longcalif Credited to longcalif and sondt99 sondt99 sondt99
Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions. Moderate Unreviewed
CVE-2026-65496 was published Jul 23, 2026
Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions. High Unreviewed
CVE-2026-65516 was published Jul 23, 2026
Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions. Moderate Unreviewed
CVE-2026-65467 was published Jul 23, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database