Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,849
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,158
Rust
1,585
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,513
Rust
20

3,558 advisories

Loading
league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal Moderate
GHSA-97jj-33gv-5xf9 was published for league/commonmark (Composer) Sep 30, 2026
4n86rakam1 Credited to 4n86rakam1
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration Moderate
CVE-2026-62998 was published for redaxo/source (Composer) Sep 24, 2026
de3erve-hunter Credited to de3erve-hunter
Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated) Moderate
CVE-2026-92692 was published for sulu/sulu (Composer) Sep 23, 2026
Solspace Freeform: Limited Twig template injection via submitted field values Moderate
CVE-2026-73858 was published for solspace/craft-freeform (Composer) Sep 23, 2026
wakedxy Credited to wakedxy
WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost Moderate
CVE-2026-88974 was published for wp-graphql/wp-graphql (Composer) Sep 23, 2026
rajukani100 Credited to rajukani100
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates Moderate
CVE-2026-63000 was published for redaxo/source (Composer) Sep 23, 2026
de3erve-hunter Credited to de3erve-hunter
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames Moderate
CVE-2026-63002 was published for redaxo/source (Composer) Sep 23, 2026
de3erve-hunter Credited to de3erve-hunter
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` Moderate
CVE-2026-63001 was published for redaxo/source (Composer) Sep 23, 2026
de3erve Credited to de3erve
Paymenter has a credit-refund double-spend race condition in service downgrade (doUpgrade) Moderate
CVE-2026-71537 was published for paymenter/paymenter (Composer) Sep 18, 2026
Pig-Tail Credited to Pig-Tail and CorwinDev CorwinDev CorwinDev
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) Moderate
GHSA-9rcc-pmj8-ffhr was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
arpitjain099 Credited to arpitjain099
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token Moderate
CVE-2026-77616 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`) Moderate
CVE-2026-77610 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
Semantic MediaWiki has an open redirect in Special:URIResolver Moderate
CVE-2026-77609 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS Moderate
CVE-2026-77607 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) Moderate
CVE-2026-77608 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers Moderate
CVE-2026-77606 was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
krabina Credited to krabina
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate Moderate
CVE-2026-75834 was published for getgrav/grav (Composer) Sep 17, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
Grav: Stored XSS via Markdown audio/video media <source> URL Moderate
CVE-2026-75831 was published for getgrav/grav (Composer) Sep 17, 2026
alimony Credited to alimony
Grav: Stored XSS via quoted-attribute bypass in detectXss Moderate
CVE-2026-72832 was published for getgrav/grav (Composer) Sep 17, 2026
koyokr Credited to koyokr
Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer Moderate
CVE-2026-61449 was published for getgrav/grav (Composer) Sep 17, 2026
iliaal Credited to iliaal
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav Moderate
CVE-2026-58657 was published for getgrav/grav (Composer) Sep 16, 2026
DavidCarliez Credited to DavidCarliez
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation Moderate
CVE-2026-61453 was published for getgrav/grav (Composer) Sep 16, 2026
alienkeric Credited to alienkeric and gemstone-source gemstone-source gemstone-source
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() Moderate
CVE-2026-59193 was published for getgrav/grav (Composer) Sep 16, 2026
Scriptmagum Credited to Scriptmagum
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph) Moderate
CVE-2026-56830 was published for shopper/framework (Composer) Sep 11, 2026
Shopping privilege escalation through missing authorization in Settings components Moderate
CVE-2026-56826 was published for shopper/framework (Composer) Sep 11, 2026
baradika Credited to baradika
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database