Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

5,008 advisories

Loading
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation Critical
CVE-2026-94603 was published for github.com/containers/podman (Go) Oct 15, 2026
SFTPGo source-side file-pattern filter bypass during copy operations Moderate
CVE-2026-103028 was published for github.com/drakkan/sftpgo/v2 (Go) Oct 15, 2026
arpitjain099 Credited to arpitjain099
containerd: Unpack DoS via repeated opaque whiteouts Moderate
CVE-2026-95838 was published for github.com/containerd/containerd (Go) Oct 15, 2026
jake-ciolek Credited to jake-ciolek
Distribution: Client `manifests.Get()` does not verify returned content against requested digest Moderate
CVE-2026-85747 was published for github.com/distribution/distribution/v3 (Go) Oct 15, 2026
KrisKennawayDD Credited to KrisKennawayDD
containerd CRI plugin: Checkpoint restore bypasses destination security context High
CVE-2026-95837 was published for github.com/containerd/containerd/v2 (Go) Oct 15, 2026
l2yyd5 Credited to l2yyd5
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter High
CVE-2026-100353 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
eros938 Credited to eros938 and hash3liZer hash3liZer hash3liZer
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash High
CVE-2026-100354 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
eros938 Credited to eros938 and hash3liZer hash3liZer hash3liZer
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path High
CVE-2026-100352 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
eros938 Credited to eros938 and hash3liZer hash3liZer hash3liZer
Talos Linux: Support bundle does not redact registry credentials Low
CVE-2026-77564 was published for github.com/talos-systems/talos (Go) Oct 15, 2026
Thanzex Credited to Thanzex
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication Critical
CVE-2026-77524 was published for github.com/kedacore/keda (Go) Oct 15, 2026
cherez0ff Credited to cherez0ff, the-vibe-dev, everping, zwindler, b0b0haha, and j311yl0v3u the-vibe-dev the-vibe-dev
everping everping zwindler zwindler b0b0haha b0b0haha j311yl0v3u j311yl0v3u
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks Critical
CVE-2026-77459 was published for github.com/argoproj/argo-cd/v2 (Go) Oct 15, 2026
RealFakeAccount Credited to RealFakeAccount, AdamKorcz, 0xshylines, thevilledev, HenriWilliams, cherez0ff, and zwindler AdamKorcz AdamKorcz
0xshylines 0xshylines thevilledev thevilledev HenriWilliams HenriWilliams cherez0ff cherez0ff zwindler zwindler
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion High
CVE-2026-100351 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
satokan Credited to satokan
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression Moderate
CVE-2026-100350 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
matiasinsaurralde Credited to matiasinsaurralde
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service Critical
CVE-2026-102748 was published for github.com/dgraph-io/dgraph/v25 (Go) Oct 15, 2026
0d000721999 Credited to 0d000721999
Vitess vttablet /twopcz reflected XSS Critical
CVE-2026-104252 was published for vitess.io/vitess (Go) Oct 15, 2026
xylove21 Credited to xylove21
kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) Moderate
CVE-2026-100348 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
arpitjain099 Credited to arpitjain099
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path Moderate
CVE-2026-100347 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
manus-use Credited to manus-use
Gotify: Insufficiently Protected Password Change endpoint Moderate
CVE-2026-102603 was published for github.com/gotify/server/v2 (Go) Oct 15, 2026
scumfrog Credited to scumfrog
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant Moderate
CVE-2026-100394 was published for github.com/nezhahq/nezha (Go) Oct 15, 2026
thesmartshadow Credited to thesmartshadow
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items High
CVE-2026-97394 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
matiasinsaurralde Credited to matiasinsaurralde
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module High
CVE-2026-82416 was published for github.com/dunglas/frankenphp (Go) Oct 15, 2026
dunglas Credited to dunglas
SFTPGo: Denial of service via malformed SSH channel request Moderate
CVE-2026-77375 was published for github.com/drakkan/sftpgo/v2 (Go) Oct 15, 2026
arnimar Credited to arnimar
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools High
CVE-2026-84360 was published for github.com/0xJacky/Nginx-UI (Go) Oct 15, 2026
Vincent550102 Credited to Vincent550102
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable Moderate
CVE-2026-84321 was published for github.com/0xJacky/Nginx-UI (Go) Oct 15, 2026
Vincent550102 Credited to Vincent550102
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) High
CVE-2026-84316 was published for github.com/0xJacky/Nginx-UI (Go) Oct 15, 2026
novice-22 Credited to novice-22
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database