Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,772
Maven
5,000+
npm
5,000+
NuGet
1,124
pip
5,000+
Pub
13
RubyGems
1,152
Rust
1,576
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
20

655 advisories

Loading
Duplicate Advisory: Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin Critical
GHSA-m97h-2qj3-5773 was published for getgrav/grav (Composer) Aug 18, 2026 • withdrawn
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS Critical
CVE-2026-75828 was published for getgrav/grav (Composer) Sep 17, 2026
arpitjain099 Credited to arpitjain099
Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write Critical
GHSA-fwwx-3362-3947 was published for getgrav/grav (Composer) Aug 18, 2026 • withdrawn
Duplicate Advisory: Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS Critical
GHSA-9pr6-8r9w-wvmj was published for getgrav/grav (Composer) Aug 18, 2026 • withdrawn
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write Critical
CVE-2026-75827 was published for getgrav/grav (Composer) Sep 17, 2026
arpitjain099 Credited to arpitjain099
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection Critical
CVE-2026-79752 was published for cakephp/cakephp (Composer) Sep 17, 2026
unknownhad Credited to unknownhad
Duplicate Advisory: Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match Critical
GHSA-qh7h-6c7g-x8m6 was published for getgrav/grav (Composer) Aug 25, 2026 • withdrawn
Chamilo LMS CStudio upload flow allows unauthenticated remote code execution Critical
CVE-2026-45140 was published for chamilo/chamilo-lms (Composer) Sep 17, 2026
h4knet Credited to h4knet
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections Critical
CVE-2026-84372 was published for predis/predis (Composer) Sep 8, 2026
s2x Credited to s2x
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver Critical
CVE-2026-77635 was published for cakephp/cakephp (Composer) Sep 8, 2026
Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element Critical
GHSA-4hc4-qjfx-wjf3 was published for craftcms/cms (Composer) Aug 11, 2026 • withdrawn
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name Critical
CVE-2026-55634 was published for pimcore/pimcore (Composer) Aug 28, 2026
Yanchon918s Credited to Yanchon918s
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502) Critical
CVE-2026-55220 was published for pimcore/pimcore (Composer) Aug 28, 2026
tonghuaroot Credited to tonghuaroot
shlink has a Server-Side Request Forgery issue Critical
CVE-2026-50887 was published for shlinkio/shlink (Composer) Jun 15, 2026
Project Firefly III has incorrect access control in the webhook management component Critical
CVE-2026-50886 was published for grumpydictator/firefly-iii (Composer) Jun 15, 2026
Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE) Critical
CVE-2026-59989 was published for phalcon/cphalcon (Composer) Aug 21, 2026
nikkoenggaliano Credited to nikkoenggaliano
Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints Critical
CVE-2026-62988 was published for froxlor/froxlor (Composer) Aug 18, 2026
muhammadahmad62 Credited to muhammadahmad62
jmespath.php has CompilerRuntime code injection via unescaped function names Critical
CVE-2026-54133 was published for mtdowling/jmespath.php (Composer) Aug 18, 2026
edorian Credited to edorian
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules Critical
CVE-2026-63223 was published for codeigniter4/framework (Composer) Aug 7, 2026
wnsgurd90-keke Credited to wnsgurd90-keke
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions Critical
CVE-2026-63221 was published for codeigniter4/framework (Composer) Aug 7, 2026
gr8man Credited to gr8man
Craft CMS: Passkey login accepts replayed WebAuthn assertions Critical
GHSA-wg23-69c2-gjc8 was published for craftcms/cms (Composer) Aug 7, 2026
Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction. Critical
CVE-2026-54588 was published for poweradmin/poweradmin (Composer) Jul 28, 2026
mike197312 Credited to mike197312
goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files Critical
CVE-2026-31843 was published for goodoneuz/pay-uz (Composer) Apr 16, 2026
shaxzodbek-uzb Credited to shaxzodbek-uzb
Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password Critical
GHSA-f25v-x6vr-962g was published for pheditor/pheditor (Composer) Jul 24, 2026
sermikr0 Credited to sermikr0
class.upload.php in verot.net omits .pht from the set of dangerous file extensions Critical
CVE-2019-19634 was published for verot/class.upload.php (Composer) Feb 28, 2020
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database