Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,436
Maven
5,000+
npm
5,000+
NuGet
883
pip
4,694
Pub
13
RubyGems
1,029
Rust
1,212
Swift
53
Unreviewed advisories
All unreviewed
5,000+

29,521 advisories

Loading
Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) Critical
GHSA-xg6x-h9c9-2m83 was published for better-auth (npm) Apr 3, 2026
TriDecent Credited to TriDecent
OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile Critical
GHSA-9p3r-hh9g-5cmg was published for openclaw (npm) Apr 3, 2026
AntAISecurityLab Credited to AntAISecurityLab
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an... Critical Unreviewed
CVE-2026-26135 was published Apr 3, 2026
Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges... Critical Unreviewed
CVE-2026-32213 was published Apr 3, 2026
Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker... Critical Unreviewed
CVE-2026-32211 was published Apr 3, 2026
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate... Critical Unreviewed
CVE-2026-33107 was published Apr 3, 2026
Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to... Critical Unreviewed
CVE-2026-33105 was published Apr 3, 2026
Hirschmann HiEOS devices contain an authentication bypass vulnerability in the HTTP(S) management... Critical Unreviewed
CVE-2024-14034 was published Apr 2, 2026
HiOS Switch Platform contains a denial-of-service vulnerability in the web interface that allows... Critical Unreviewed
CVE-2025-15620 was published Apr 2, 2026
OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation Critical
GHSA-g5cg-8x5w-7jpm was published for openclaw (npm) Apr 2, 2026
AntAISecurityLab Credited to AntAISecurityLab
Dgraph: Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization Critical
CVE-2026-34976 was published for github.com/dgraph-io/dgraph (Go) Apr 2, 2026
kodareef5 Credited to kodareef5
fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key Critical
CVE-2026-34950 was published for fast-jwt (npm) Apr 2, 2026
rtvkiz Credited to rtvkiz
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions Critical
GHSA-3hfp-gqgh-xc5g was published for @lightdash/cli (npm) Apr 2, 2026
Axios npm Supply Chain Incident Impacting @usebruno/cli Critical
CVE-2026-34841 was published for @usebruno/cli (npm) Apr 2, 2026
An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0.... Critical Unreviewed
CVE-2026-34877 was published Apr 2, 2026
An issue was discovered in Percona PMM before 3.7. Because an internal database user retains... Critical Unreviewed
CVE-2026-25212 was published Apr 2, 2026
Agno is vulnerable to Eval Injection Critical
CVE-2026-35002 was published for agno (pip) Apr 2, 2026
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to... Critical Unreviewed
CVE-2026-2699 was published Apr 2, 2026
Authenticated user can upload a malicious file to the server and execute it, which leads to... Critical Unreviewed
CVE-2026-2701 was published Apr 2, 2026
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in... Critical Unreviewed
CVE-2026-33615 was published Apr 2, 2026
Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster Critical
CVE-2026-4370 was published for github.com/juju/juju (Go) Apr 2, 2026
hpidcock Credited to hpidcock, tlm, manadart, and wallyworld tlm tlm
manadart manadart wallyworld wallyworld
PraisonAI Has Authentication Bypass via OAuthManager.validate_token() Critical
CVE-2026-34953 was published for praisonai (pip) Apr 1, 2026
YeranG30 Credited to YeranG30
PraisonAI Has Missing Authentication in WebSocket Gateway Critical
CVE-2026-34952 was published for praisonai (pip) Apr 1, 2026
YeranG30 Credited to YeranG30
PraisonAI Has Second-Order SQL Injection in `get_all_user_threads` Critical
CVE-2026-34934 was published for praisonai (pip) Apr 1, 2026
YeranG30 Credited to YeranG30
PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command() Critical
CVE-2026-34935 was published for praisonai (pip) Apr 1, 2026
YeranG30 Credited to YeranG30
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database