Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

2,437 advisories

Loading
django CMS: Structure endpoint bypasses page-view permission Moderate
CVE-2026-54624 was published for django-cms (pip) Aug 20, 2026
Zyy0530 Credited to Zyy0530, Str1ckl4nd, 7thParkk, and mauriceng98 Str1ckl4nd Str1ckl4nd
7thParkk 7thParkk mauriceng98 mauriceng98
django CMS: Clipboard copy IDOR discloses unauthorized plugin content Moderate
CVE-2026-54622 was published for django-cms (pip) Aug 20, 2026
Str1ckl4nd Credited to Str1ckl4nd, 7thParkk, and mauriceng98 7thParkk 7thParkk
mauriceng98 mauriceng98
Wagtail: Pages translations can be created without page permissions when using simple_translation Moderate
CVE-2026-54262 was published for wagtail (pip) Aug 20, 2026
devansh3008 Credited to devansh3008, zerolab, gasman, and iaohkut-from-NightWolf-Team zerolab zerolab
gasman gasman iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team
Wagtail: Improper permission handling in image preview Moderate
CVE-2026-54261 was published for wagtail (pip) Aug 20, 2026
zerolab Credited to zerolab, 0x1saac, and harshakshit 0x1saac 0x1saac
harshakshit harshakshit
Wagtail: Denial of service via unbounded filter specs in the image preview Moderate
CVE-2026-54260 was published for wagtail (pip) Aug 20, 2026
zerolab Credited to zerolab and 0x1saac 0x1saac 0x1saac
Wagtail: Improper restriction handling on Documents and Images chosen endpoints Moderate
CVE-2026-54259 was published for wagtail (pip) Aug 20, 2026
harshakshit Credited to harshakshit, zerolab, and gasman zerolab zerolab
gasman gasman
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl Moderate
GHSA-mc9m-6fm9-pghc was published for kcl-lib (pip) Aug 20, 2026
maxammann Credited to maxammann
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service Moderate
GHSA-jgvr-6x5w-hx5w was published for kcl-lib (pip) Aug 20, 2026
maxammann Credited to maxammann
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address Moderate
GHSA-5p3m-vhh6-9236 was published for stigmem-node (pip) Aug 20, 2026
chaitanyagarware Credited to chaitanyagarware
asteval has a Sandbox Escape via BaseException Subclasses Moderate
CVE-2026-55244 was published for asteval (pip) Aug 20, 2026
mhamzakhattak Credited to mhamzakhattak
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter Moderate
GHSA-9w56-46f6-3qhx was published for asteval (pip) Aug 20, 2026
thegr1ffyn Credited to thegr1ffyn
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation Moderate
CVE-2026-55236 was published for langgraph-api (pip) Aug 19, 2026
OneThing4101 Credited to OneThing4101
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication Moderate
CVE-2026-55235 was published for langgraph-api (pip) Aug 19, 2026
BedheadProgrammer Credited to BedheadProgrammer
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE) Moderate
CVE-2026-73974 was published for linuxfabrik-lib (pip) Aug 18, 2026
manus-use Credited to manus-use
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False Moderate
CVE-2026-71322 was published for lemur (pip) Aug 18, 2026
sour-exploit Credited to sour-exploit
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority Moderate
CVE-2026-71317 was published for lemur (pip) Aug 18, 2026
maperu Credited to maperu
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for GHSA-54vg-pfh7-jq95) Moderate
CVE-2026-70667 was published for lemur (pip) Aug 18, 2026
abhinav9-coder Credited to abhinav9-coder
devpi-server may leak database contents Moderate
CVE-2026-54723 was published for devpi-server (pip) Aug 18, 2026
pavelrevak Credited to pavelrevak
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads Moderate
CVE-2026-68922 was published for mobsf (pip) Aug 18, 2026
Daniel-GrunbergerCA Credited to Daniel-GrunbergerCA
MobSF's CSRF checks not enforced after Django migration Moderate
CVE-2026-68923 was published for mobsf (pip) Aug 18, 2026
ya3raj Credited to ya3raj
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction Moderate
CVE-2026-68924 was published for mobsf (pip) Aug 18, 2026
ya3raj Credited to ya3raj
Copyparty vulnerable to file/dirkey confusion Moderate
CVE-2026-70657 was published for copyparty (pip) Aug 18, 2026
poolcritter Credited to poolcritter
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config Moderate
CVE-2026-68520 was published for glances (pip) Aug 17, 2026
0xTodor Credited to 0xTodor
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes Moderate
CVE-2026-59894 was published for sqlparse (pip) Aug 17, 2026
7thParkk Credited to 7thParkk
Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard Moderate
CVE-2026-68517 was published for glances (pip) Aug 17, 2026
geo-chen Credited to geo-chen
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database