Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,845
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,158
Rust
1,578
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,513
Rust
20

3,407 advisories

Loading
Yamcs has DOM XSS in Extension Routing Moderate
CVE-2026-55566 was published for org.yamcs:yamcs-core (Maven) Aug 28, 2026
suffs811 Credited to suffs811 and rgfradique rgfradique rgfradique
Jenkins Zowe zDevOps Plugin has a missing permission check Moderate
CVE-2026-57307 was published for io.jenkins.plugins:zdevops (Maven) Jun 24, 2026
Jenkins Assembla Plugin has a cross-site request forgery (CSRF) vulnerability Moderate
CVE-2026-57305 was published for org.jenkins-ci.plugins:assembla (Maven) Jun 24, 2026
Jenkins Zowe zDevOps Plugin has a CSRF vulnerability Moderate
CVE-2026-57306 was published for io.jenkins.plugins:zdevops (Maven) Jun 24, 2026
Jenkins Assembla Plugin has a missing permission check Moderate
CVE-2026-57304 was published for org.jenkins-ci.plugins:assembla (Maven) Jun 24, 2026
Jenkins FitNesse Plugin stores passwords unencrypted Moderate
CVE-2026-57302 was published for org.jenkins-ci.plugins:fitnesse (Maven) Jun 24, 2026
Jenkins MCP Server Plugin missing a permission check Moderate
CVE-2026-57300 was published for io.jenkins.plugins:mcp-server (Maven) Jun 24, 2026
Jenkins Contrast Continuous Application Security Plugin missing permission checks Moderate
CVE-2026-57299 was published for org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) Jun 24, 2026
Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability Moderate
CVE-2026-57298 was published for org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) Jun 24, 2026
Jenkins Gitee Plugin missing permission checks Moderate
CVE-2026-57291 was published for org.jenkins-ci.plugins:gitee (Maven) Jun 24, 2026
Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation Moderate
CVE-2026-57289 was published for io.jenkins.plugins:bitbucket-push-and-pull-request (Maven) Jun 24, 2026
Jenkins Priority Sorter Plugin has a CSRF vulnerability Moderate
CVE-2026-57290 was published for org.jenkins-ci.plugins:PrioritySorter (Maven) Jun 24, 2026
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs Moderate
CVE-2026-57293 was published for org.jenkins-ci.plugins:gitee (Maven) Jun 24, 2026
Jenkins Gitee Plugin has a cross-site request forgery vulnerability Moderate
CVE-2026-57292 was published for org.jenkins-ci.plugins:gitee (Maven) Jun 24, 2026
Jenkins EC2 Fleet Plugin has a missing permission check Moderate
CVE-2026-57294 was published for com.amazon.jenkins.fleet:ec2-fleet (Maven) Jun 24, 2026
Jenkins EC2 Fleet Plugin has a cross-site request forgery (CSRF) vulnerability Moderate
CVE-2026-57295 was published for com.amazon.jenkins.fleet:ec2-fleet (Maven) Jun 24, 2026
Jenkins Contrast Continuous Application Security Plugin has a missing permission check Moderate
CVE-2026-57297 was published for org.jenkins-ci.plugins:contrast-continuous-application-security (Maven) Jun 24, 2026
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations Moderate
CVE-2026-57287 was published for org.jenkins-ci.plugins:jobConfigHistory (Maven) Jun 24, 2026
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs Moderate
CVE-2026-57285 was published for org.jenkins-ci.plugins:github-branch-source (Maven) Jun 24, 2026
Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability Moderate
CVE-2026-57283 was published for io.jenkins.plugins:pipeline-groovy-lib (Maven) Jun 24, 2026
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names Moderate
CVE-2026-57286 was published for org.jenkins-ci.tools:git-parameter (Maven) Jun 24, 2026
Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types Moderate
CVE-2026-57284 was published for io.jenkins.plugins:pipeline-groovy-lib (Maven) Jun 24, 2026
Jenkins Git client Plugin has an OS command injection vulnerability on agents Moderate
CVE-2026-57282 was published for org.jenkins-ci.plugins:git-client (Maven) Jun 24, 2026
Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates Moderate
CVE-2025-37731 was published for org.elasticsearch.plugin:x-pack-core (Maven) Dec 15, 2025
sealonohana Credited to sealonohana and levpachmanov levpachmanov levpachmanov
Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function Moderate
CVE-2024-52980 was published for org.elasticsearch:elasticsearch-grok (Maven) Apr 8, 2025
AnonySE26 Credited to AnonySE26, sealonohana, and levpachmanov sealonohana sealonohana
levpachmanov levpachmanov
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database