Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,596
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

228 advisories

Loading
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that... High Unreviewed
CVE-2026-110859 was published Oct 15, 2026
Improper neutralization of argument delimiters in a command ('argument injection') in Windows... High Unreviewed
CVE-2026-97798 was published Oct 13, 2026
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g.,... High Unreviewed
CVE-2026-108963 was published Oct 11, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... High Unreviewed
CVE-2026-18740 was published Oct 8, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... High Unreviewed
CVE-2026-19482 was published Oct 8, 2026
ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection... High Unreviewed
CVE-2026-107639 was published Oct 8, 2026
Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other... High Unreviewed
CVE-2026-93699 was published Oct 8, 2026
An authorization and input validation vulnerability exists in Brocade Fabric OS versions before 9... High Unreviewed
CVE-2026-87687 was published Oct 8, 2026
An argument injection vulnerability exists in the configuration management command-line utility... High Unreviewed
CVE-2026-87667 was published Oct 8, 2026
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) High
CVE-2026-102827 was published for simple-git (npm) Oct 5, 2026
anir0y Credited to anir0y, bilguunbicktivism, cruzryan, the-vibe-dev, D7EAD, dellalibera, gdegrange, b1ue0ceanRun, Leeziao, internetteletubbie, and arundr0id bilguunbicktivism bilguunbicktivism
cruzryan cruzryan the-vibe-dev the-vibe-dev D7EAD D7EAD dellalibera dellalibera gdegrange gdegrange b1ue0ceanRun b1ue0ceanRun Leeziao Leeziao internetteletubbie internetteletubbie arundr0id arundr0id
Nx: OS command injection via git revisions and remote refs High
GHSA-w2vw-w76x-qr89 was published for nx (npm) Oct 5, 2026
arkmarta Credited to arkmarta
OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted... High Unreviewed
CVE-2026-100570 was published Sep 26, 2026
OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass... High Unreviewed
CVE-2026-100561 was published Sep 26, 2026
CliInvoke: Argument Injection in Extensibility Runner Factory High
CVE-2026-100369 was published for AlastairLundy.CliInvoke (NuGet) Sep 25, 2026
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as... High Unreviewed
CVE-2026-86862 was published Sep 17, 2026
Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated... High Unreviewed
CVE-2026-89036 was published Sep 17, 2026
Netcore NR255-V version 1.5.130703 contains an os command argument injection vulnerability in the... High Unreviewed
CVE-2026-76862 was published Sep 16, 2026
Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user... High Unreviewed
CVE-2026-76866 was published Sep 16, 2026
A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection... High Unreviewed
CVE-2026-19624 was published Sep 14, 2026
CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')... High Unreviewed
CVE-2026-8044 was published Sep 9, 2026
Duplicate Advisory: GitPython 3.1.59: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle High
CVE-2026-87818 was published for gitpython (pip) Sep 9, 2026 • withdrawn
bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip... High Unreviewed
CVE-2026-87794 was published Sep 9, 2026
CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval High
CVE-2026-75912 was published for codewhale (npm) Sep 4, 2026
0xEr3n Credited to 0xEr3n
CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval High
CVE-2026-75913 was published for codewhale (npm) Sep 4, 2026
0xEr3n Credited to 0xEr3n
git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object... High Unreviewed
CVE-2026-85626 was published Sep 4, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database