GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
9 advisories
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root
Moderate
CVE-2026-71492
was published
for
banks
(pip)
Sep 2, 2026
PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Critical
CVE-2026-47407
was published
for
praisonai-platform
(pip)
May 29, 2026
NodeVM observability builtins leak host process and HTTP request data
Moderate
CVE-2026-47141
was published
for
vm2
(npm)
May 29, 2026
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
High
CVE-2026-47139
was published
for
vm2
(npm)
May 29, 2026
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
Critical
CVE-2026-47140
was published
for
vm2
(npm)
May 29, 2026
Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads
Moderate
CVE-2026-33440
was published
for
weblate
(pip)
Apr 16, 2026
Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository
Moderate
CVE-2026-33220
was published
for
weblate
(pip)
Apr 16, 2026
Parse Server: MFA recovery code single-use bypass via concurrent requests
Low
CVE-2026-33624
was published
for
parse-server
(npm)
Mar 24, 2026
Statamic has a path traversal in file dictionary fieldtype
Moderate
CVE-2026-33171
was published
for
statamic/cms
(Composer)
Mar 18, 2026
ProTip!
Advisories are also available from the
GraphQL API