Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
42
GitHub Actions
43
Go
3,151
Maven
5,000+
npm
5,000+
NuGet
859
pip
4,450
Pub
12
RubyGems
991
Rust
1,179
Swift
50
Unreviewed advisories
All unreviewed
5,000+

6 advisories

Loading
`vega-functions` vulnerable to Cross-site Scripting via `setdata` function High
CVE-2025-66648 was published for vega-functions (npm) Jan 5, 2026
nikolaybabiy Credited to nikolaybabiy, hydrosquall, and domoritz hydrosquall hydrosquall
domoritz domoritz
Vega XSS via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope High
CVE-2025-65110 was published for vega-selections (npm) Jan 5, 2026
nickcopi Credited to nickcopi, hydrosquall, and domoritz hydrosquall hydrosquall
domoritz domoritz
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable High
CVE-2025-59840 was published for vega (npm) Nov 13, 2025
nickcopi Credited to nickcopi, hydrosquall, domoritz, jeramysoucy, lsh, and kachkaev hydrosquall hydrosquall
domoritz domoritz jeramysoucy jeramysoucy lsh lsh kachkaev kachkaev
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] Moderate
CVE-2025-27793 was published for vega (npm) Mar 27, 2025
FallingPineapples Credited to FallingPineapples, hydrosquall, and domoritz hydrosquall hydrosquall
domoritz domoritz
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter Moderate
CVE-2025-26619 was published for vega (npm) Mar 27, 2025
kprevas Credited to kprevas, hydrosquall, domoritz, mattijn, and lsh hydrosquall hydrosquall
domoritz domoritz mattijn mattijn lsh lsh
Vega allows Cross-site Scripting via the vlSelectionTuples function Moderate
CVE-2025-25304 was published for vega (npm) Feb 14, 2025
FallingPineapples Credited to FallingPineapples and domoritz domoritz domoritz
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database