Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
41
GitHub Actions
42
Go
3,131
Maven
5,000+
npm
5,000+
NuGet
830
pip
4,436
Pub
12
RubyGems
988
Rust
1,172
Swift
50
Unreviewed advisories
All unreviewed
5,000+

50 advisories

Loading
vLLM has RCE In Video Processing Critical
CVE-2026-22778 was published for vllm (pip) Feb 2, 2026
dan-sec-ops Credited to dan-sec-ops, DarkLight1337, and russellb DarkLight1337 DarkLight1337
russellb russellb
The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all... Critical Unreviewed
CVE-2025-11008 was published Nov 4, 2025
Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging... Critical Unreviewed
CVE-2025-34183 was published Sep 16, 2025
An issue was discovered in BMC Control-M 9.0.21.300. When Control-M Server has a database... Critical Unreviewed
CVE-2025-48709 was published Aug 7, 2025
iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive... Critical Unreviewed
CVE-2025-22275 was published Jan 3, 2025
An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with... Critical Unreviewed
CVE-2024-6060 was published Jun 26, 2024
@valtimo/components exposes access token to form.io Critical
CVE-2024-34706 was published for @valtimo/components (npm) May 13, 2024
Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage... Critical Unreviewed
CVE-2022-36407 was published Mar 25, 2024
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion... Critical Unreviewed
CVE-2023-36649 was published Dec 12, 2023
If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the... Critical Unreviewed
CVE-2023-46668 was published Oct 26, 2023
Argo CD cluster secret might leak in cluster details page Critical
CVE-2023-40029 was published for github.com/argoproj/argo-cd/v2 (Go) Sep 11, 2023
alexmt Credited to alexmt
check-spelling workflow vulnerable to token leakage via symlink attack Critical
CVE-2021-32724 was published for check-spelling/check-spelling (GitHub Actions) Jul 29, 2022
justinsteven Credited to justinsteven
Weave GitOps leaked cluster credentials into logs on connection errors Critical
CVE-2022-31098 was published for github.com/weaveworks/weave-gitops (Go) Jun 23, 2022
stefanprodan Credited to stefanprodan
A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate... Critical Unreviewed
CVE-2021-37759 was published May 24, 2022
A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate... Critical Unreviewed
CVE-2021-37760 was published May 24, 2022
A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens... Critical Unreviewed
CVE-2021-3528 was published May 24, 2022
In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log... Critical Unreviewed
CVE-2019-17395 was published May 24, 2022
In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the... Critical Unreviewed
CVE-2019-17398 was published May 24, 2022
In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in... Critical Unreviewed
CVE-2019-17396 was published May 24, 2022
In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are... Critical Unreviewed
CVE-2019-17394 was published May 24, 2022
In the Orbitz application 19.31.1 for Android, the username and password are stored in the log... Critical Unreviewed
CVE-2019-17355 was published May 24, 2022
An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade,... Critical Unreviewed
CVE-2019-15294 was published May 24, 2022
Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may... Critical Unreviewed
CVE-2016-8233 was published May 17, 2022
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log... Critical Unreviewed
CVE-2017-8074 was published May 17, 2022
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log... Critical Unreviewed
CVE-2017-8075 was published May 17, 2022
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database