Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
70
GitHub Actions
52
Go
3,904
Maven
5,000+
npm
5,000+
NuGet
967
pip
5,000+
Pub
13
RubyGems
1,062
Rust
1,374
Swift
54
Unreviewed advisories
All unreviewed
5,000+

1,395 advisories

Loading
Symfony has a UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection Moderate
CVE-2026-45065 was published for symfony/routing (Composer) May 27, 2026
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Facebook Facebook for... Moderate Unreviewed
CVE-2026-49059 was published May 27, 2026
Jenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login,... Moderate Unreviewed
CVE-2026-48924 was published May 27, 2026
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect... Low Unreviewed
CVE-2026-48589 was published May 26, 2026
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side... Moderate Unreviewed
CVE-2026-44598 was published May 26, 2026
action/cookie.php in ecrire in SPIP before 4.4.15 is prone to an open redirect vulnerability. Low Unreviewed
CVE-2026-48832 was published May 26, 2026
Improper input validation in the external authentication provider flow in Devolutions Server... Moderate Unreviewed
CVE-2026-9245 was published May 26, 2026
Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability. An... High Unreviewed
CVE-2025-26483 was published May 26, 2026
Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers Moderate
CVE-2026-46616 was published for Umbraco.Cms (NuGet) May 21, 2026
hwpark6804-gif Credited to hwpark6804-gif
ArcGIS Server contains an input validation weakness in the login redirection workflow. An... Moderate Unreviewed
CVE-2026-2813 was published May 20, 2026
A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a... High Unreviewed
CVE-2026-7504 was published May 19, 2026
SimpleSAMLphp casserver: Open Redirect in logout Moderate
CVE-2025-65954 was published for simplesamlphp/simplesamlphp-module-casserver (Composer) May 15, 2026
pradtke Credited to pradtke
CWE-601 URL redirection to untrusted site ('open redirect') Moderate Unreviewed
CVE-2026-45448 was published May 14, 2026
Authlib OIDC Implicit/Hybrid Authorization Vulnerable to Open Redirect Moderate
CVE-2026-44681 was published for authlib (pip) May 13, 2026
y011d4 Credited to y011d4
Snipe-IT has an open redirect vulnerability Moderate
CVE-2026-44833 was published for snipe/snipe-it (Composer) May 8, 2026
CE2Sec Credited to CE2Sec
Electerm has an unvalidated shell.openExternal that allows arbitrary protocol execution via terminal link click High
CVE-2026-43941 was published for electerm (npm) May 8, 2026
osageling Credited to osageling
MCP Registry has open redirect via protocol-relative path in trailing-slash middleware Moderate
CVE-2026-44427 was published for github.com/modelcontextprotocol/registry (Go) May 8, 2026
gujasec Credited to gujasec and rdimitrov rdimitrov rdimitrov
Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler Moderate
CVE-2026-40295 was published for devise (RubyGems) May 8, 2026
offset Credited to offset
Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The... Moderate Unreviewed
CVE-2026-3318 was published May 8, 2026
Ech0's OAuth redirect URI validation ignores path component, enables exchange-code theft High
GHSA-p64j-f4x9-wq66 was published for github.com/lin-snow/Ech0 (Go) May 7, 2026
adrgs Credited to adrgs and aisafe-bot aisafe-bot aisafe-bot
URL redirection to untrusted site ('open redirect') vulnerability in DivvyDrive Information... Critical Unreviewed
CVE-2026-6795 was published May 7, 2026
docling-graph has SSRF via Missing Internal IP Validation in URLInputHandler Moderate
CVE-2026-44520 was published for docling-graph (pip) May 7, 2026
ayoub-ibm Credited to ayoub-ibm and dolfim-ibm dolfim-ibm dolfim-ibm
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect High
CVE-2026-44503 was published for Microsoft.Kiota.Abstractions (Go) May 7, 2026
MIchaelMainer Credited to MIchaelMainer
Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix Moderate
CVE-2026-44437 was published for @angular/ssr (npm) May 6, 2026
kimkou2024 Credited to kimkou2024, alan-agius4, dgp1130, and AndrewKushnir alan-agius4 alan-agius4
dgp1130 dgp1130 AndrewKushnir AndrewKushnir
Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route Rules Moderate
CVE-2026-44372 was published for nitro (npm) May 6, 2026
0x0OZ Credited to 0x0OZ
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database