Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,788
Maven
5,000+
npm
5,000+
NuGet
1,124
pip
5,000+
Pub
13
RubyGems
1,152
Rust
1,576
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
20

572 advisories

Loading
Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS) High
CVE-2026-81516 was published for Steeltoe.Discovery.Consul (NuGet) Sep 17, 2026
manus-use Credited to manus-use
Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS) High
CVE-2026-81515 was published for Steeltoe.Discovery.Eureka (NuGet) Sep 17, 2026
manus-use Credited to manus-use
SSH.NET: ScpClient allows server-side RCE via default SCP path handling High
CVE-2026-85756 was published for SSH.NET (NuGet) Sep 17, 2026
Nadav0077 Credited to Nadav0077
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion High
CVE-2026-69197 was published for Umbraco.Cms (NuGet) Sep 17, 2026
suryadina Credited to suryadina
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS High
CVE-2026-81192 was published for OpenTelemetry.Resources.Host (NuGet) Sep 16, 2026
martincostello Credited to martincostello and lachmatt lachmatt lachmatt
Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability High
CVE-2026-69522 was published for Microsoft.DiaSymReader.Native (NuGet) Sep 9, 2026
Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability High
CVE-2026-69439 was published for Microsoft.DiaSymReader.Native (NuGet) Sep 9, 2026
Duplicate Advisory: Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability High
GHSA-mqvm-gmc4-6rv2 was published for Microsoft.DiaSymReader.Native (NuGet) Sep 8, 2026 • withdrawn
Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability High
CVE-2026-71328 was published for Microsoft.DiaSymReader.Native (NuGet) Sep 9, 2026
Duplicate Advisory: Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability High
GHSA-4qhr-qf46-fcrx was published for Microsoft.DiaSymReader.Native (NuGet) Sep 8, 2026 • withdrawn
Duplicate Advisory: Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability High
GHSA-q72m-f2r4-w4cw was published for Microsoft.DiaSymReader.Native (NuGet) Sep 8, 2026 • withdrawn
Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability High
CVE-2026-50646 was published for Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Sep 8, 2026
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect High
CVE-2026-44503 was published for Microsoft.Kiota.Abstractions (Go) May 7, 2026
MIchaelMainer Credited to MIchaelMainer, awsactran, and sgracia714 awsactran awsactran
sgracia714 sgracia714
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames High
CVE-2026-48798 was published for SSH.NET (NuGet) Aug 12, 2026
Nadav0077 Credited to Nadav0077 and igorpyan igorpyan igorpyan
Kiota: Code Generation Literal Injection High
CVE-2026-41134 was published for Microsoft.OpenApi.Kiota (NuGet) Apr 14, 2026
baywet Credited to baywet and gavinbarron gavinbarron gavinbarron
Microsoft Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref High
CVE-2026-59867 was published for Microsoft.OpenApi.Kiota (NuGet) Jul 24, 2026
Gal3m Credited to Gal3m, mrostamipoor, baywet, and gavinbarron mrostamipoor mrostamipoor
baywet baywet gavinbarron gavinbarron
Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName High
CVE-2026-59866 was published for Microsoft.OpenApi.Kiota (NuGet) Jul 24, 2026
Gal3m Credited to Gal3m, mrostamipoor, baywet, and gavinbarron mrostamipoor mrostamipoor
baywet baywet gavinbarron gavinbarron
Microsoft Kiota Workspace-config poisoning: out-of-repo file write + generation-time SSRF High
CVE-2026-59863 was published for Microsoft.OpenApi.Kiota (NuGet) Jul 24, 2026
Gal3m Credited to Gal3m, mrostamipoor, baywet, and gavinbarron mrostamipoor mrostamipoor
baywet baywet gavinbarron gavinbarron
Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator High
CVE-2026-59859 was published for Microsoft.OpenApi.Kiota (NuGet) Jul 24, 2026
peombwa Credited to peombwa and thegr1ffyn thegr1ffyn thegr1ffyn
Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator High
CVE-2026-59862 was published for Microsoft.OpenAPI.Kiota (NuGet) Jul 24, 2026
baywet Credited to baywet
Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator High
CVE-2026-59861 was published for Microsoft.OpenAPI.Kiota (NuGet) Jul 24, 2026
baywet Credited to baywet
Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection High
CVE-2026-59860 was published for Microsoft.OpenApi.Kiota (NuGet) Jul 24, 2026
thegr1ffyn Credited to thegr1ffyn, gavinbarron, and peombwa gavinbarron gavinbarron
peombwa peombwa
SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS) High
GHSA-pfvm-w89x-94jw was published for SIPSorcery (NuGet) Aug 12, 2026
manus-use Credited to manus-use
SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing High
GHSA-jwjp-4649-v8jp was published for SIPSorcery (NuGet) Aug 12, 2026
manus-use Credited to manus-use
Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability High
CVE-2026-62871 was published for Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Aug 11, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database