Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,974
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

440 advisories

Loading
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that... High Unreviewed
CVE-2026-110859 was published Oct 15, 2026
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull(... Critical Unreviewed
CVE-2026-110858 was published Oct 15, 2026
Improper neutralization of argument delimiters in a command ('argument injection') in Windows... High Unreviewed
CVE-2026-97798 was published Oct 13, 2026
Potential arbitrary code execution, under specific configurations. Critical Unreviewed
CVE-2026-92892 was published Oct 13, 2026
yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows... Moderate Unreviewed
CVE-2026-109966 was published Oct 13, 2026
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g.,... High Unreviewed
CVE-2026-108963 was published Oct 11, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... Low Unreviewed
CVE-2026-11939 was published Oct 8, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... High Unreviewed
CVE-2026-18740 was published Oct 8, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... High Unreviewed
CVE-2026-19482 was published Oct 8, 2026
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection... High Unreviewed
CVE-2026-107639 was published Oct 8, 2026
An authenticated high privilege user can inject arguments in troubleshooting commands resulting... Critical Unreviewed
CVE-2026-107510 was published Oct 8, 2026
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other... High Unreviewed
CVE-2026-93699 was published Oct 8, 2026
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9... High Unreviewed
CVE-2026-87687 was published Oct 8, 2026
An argument injection vulnerability exists in the configuration management command-line utility... High Unreviewed
CVE-2026-87667 was published Oct 8, 2026
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) High
CVE-2026-102827 was published for simple-git (npm) Oct 5, 2026
anir0y Credited to anir0y, bilguunbicktivism, cruzryan, the-vibe-dev, D7EAD, dellalibera, gdegrange, b1ue0ceanRun, Leeziao, internetteletubbie, and arundr0id bilguunbicktivism bilguunbicktivism
cruzryan cruzryan the-vibe-dev the-vibe-dev D7EAD D7EAD dellalibera dellalibera gdegrange gdegrange b1ue0ceanRun b1ue0ceanRun Leeziao Leeziao internetteletubbie internetteletubbie arundr0id arundr0id
Nx: OS command injection via git revisions and remote refs High
GHSA-w2vw-w76x-qr89 was published for nx (npm) Oct 5, 2026
arkmarta Credited to arkmarta
cjbassi/gotop is vulnerable to local argument injection via process termination functionality.... Moderate Unreviewed
CVE-2026-91784 was published Oct 2, 2026
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI... Moderate Unreviewed
CVE-2026-103505 was published Oct 1, 2026
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs Moderate
CVE-2026-102904 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle Moderate
GHSA-whh4-5q6c-9v3x was published for gitpython (pip) Sep 30, 2026
kokomaru167 Credited to kokomaru167
Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting:... Critical Unreviewed
CVE-2026-100714 was published Sep 26, 2026
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted... High Unreviewed
CVE-2026-100570 was published Sep 26, 2026
OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass... High Unreviewed
CVE-2026-100561 was published Sep 26, 2026
CliInvoke: Argument Injection in Extensibility Runner Factory High
CVE-2026-100369 was published for AlastairLundy.CliInvoke (NuGet) Sep 25, 2026
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated... Critical Unreviewed
CVE-2026-87900 was published Sep 23, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database