Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,741
Maven
5,000+
npm
5,000+
NuGet
1,116
pip
5,000+
Pub
13
RubyGems
1,152
Rust
1,570
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

31 advisories

Loading
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination Moderate
CVE-2026-88016 was published for github.com/rclone/rclone (Go) Sep 10, 2026
manus-use Credited to manus-use and ncw ncw ncw
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin High
CVE-2026-87995 was published for open-webui (pip) Sep 10, 2026
manus-use Credited to manus-use and Classic298 Classic298 Classic298
GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251) Moderate
CVE-2026-78679 was published for GitPython (pip) Sep 8, 2026
manus-use Credited to manus-use
GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame() Moderate
CVE-2026-78678 was published for GitPython (pip) Sep 8, 2026
manus-use Credited to manus-use
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph High
CVE-2026-82392 was published for pnpm (npm) Sep 2, 2026
manus-use Credited to manus-use
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension High
GHSA-8rr7-cvq3-gmfh was published for league/commonmark (Composer) Sep 1, 2026
manus-use Credited to manus-use
Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance) Critical
CVE-2026-55559 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
MarkLee131 Credited to MarkLee131 and manus-use manus-use manus-use
Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs `executeSql` Critical
CVE-2026-55511 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
Yanchon918s Credited to Yanchon918s and manus-use manus-use manus-use
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate High
GHSA-fm29-4mq3-phg6 was published for winter/wn-backend-module (Composer) Aug 20, 2026
manus-use Credited to manus-use
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE) Moderate
CVE-2026-73974 was published for linuxfabrik-lib (pip) Aug 18, 2026
manus-use Credited to manus-use
SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS) High
GHSA-pfvm-w89x-94jw was published for SIPSorcery (NuGet) Aug 12, 2026
manus-use Credited to manus-use
SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing High
GHSA-jwjp-4649-v8jp was published for SIPSorcery (NuGet) Aug 12, 2026
manus-use Credited to manus-use
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution High
CVE-2026-76220 was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE) High
GHSA-jm78-9fvv-mhgr was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks High
CVE-2026-76218 was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use and BarakSrour BarakSrour BarakSrour
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite High
CVE-2026-76219 was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use and bhaswanthc bhaswanthc bhaswanthc
Statamic: Unsafe method invocation via Antlers template resolution allows data destruction Moderate
CVE-2026-64663 was published for statamic/cms (Composer) Aug 6, 2026
manus-use Credited to manus-use
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin High
CVE-2026-70486 was published for open-webui (pip) Aug 4, 2026
manus-use Credited to manus-use and Classic298 Classic298 Classic298
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count Moderate
GHSA-p538-c434-8v24 was published for GitPython (pip) Aug 3, 2026
manus-use Credited to manus-use
Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation High
CVE-2026-67424 was published for flyto-core (pip) Jul 30, 2026
manus-use Credited to manus-use
Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata) High
CVE-2026-67428 was published for flyto-core (pip) Jul 30, 2026
manus-use Credited to manus-use
Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration Critical
CVE-2026-67426 was published for flyto-core (pip) Jul 30, 2026
manus-use Credited to manus-use and BarakSrour BarakSrour BarakSrour
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway Critical
GHSA-68r5-9hpg-7qw9 was published for org.openidentityplatform.opendj:opendj-dsml-servlet (Maven) Jul 24, 2026
manus-use Credited to manus-use
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes High
GHSA-g3hq-hphg-8fhh was published for pheditor/pheditor (Composer) Jul 24, 2026
anir0y Credited to anir0y, manus-use, sermikr0, adamyordan, Pig-Tail, tonghuaroot, and alimony manus-use manus-use
sermikr0 sermikr0 adamyordan adamyordan Pig-Tail Pig-Tail tonghuaroot tonghuaroot alimony alimony
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback Critical
CVE-2026-62379 was published for org.openidentityplatform.openam:openam-core (Maven) Jul 24, 2026
manus-use Credited to manus-use and BarakSrour BarakSrour BarakSrour
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database