Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,624
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

6,442 advisories

Loading
Duplicate Advisory: Craft CMS: Authenticated leak of secret environment variables High
GHSA-cc2g-26rw-g997 was published for craftcms/cms (Composer) Aug 11, 2026 • withdrawn
Duplicate Advisory: Craft CMS: Authenticated RCE through Twig sandbox escape High
GHSA-h784-hpjp-2rrm was published for craftcms/cms (Composer) Aug 11, 2026 • withdrawn
Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal Moderate
GHSA-9w6w-8x3c-hfqp was published for craftcms/cms (Composer) Aug 11, 2026 • withdrawn
Duplicate Advisory: Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass High
GHSA-w36c-qxrq-v7fw was published for craftcms/cms (Composer) Aug 11, 2026 • withdrawn
Duplicate Advisory: Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts High
GHSA-2p2v-3mjg-gfpf was published for craftcms/cms (Composer) Aug 11, 2026 • withdrawn
Duplicate Advisory: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool High
GHSA-4f2f-jr2m-j7p4 was published for typo3/cms-core (Composer) Aug 11, 2026 • withdrawn
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules Critical
CVE-2026-63223 was published for codeigniter4/framework (Composer) Aug 7, 2026
wnsgurd90-keke Credited to wnsgurd90-keke
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames High
CVE-2026-63222 was published for codeigniter4/framework (Composer) Aug 7, 2026
gr8man Credited to gr8man
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions Critical
CVE-2026-63221 was published for codeigniter4/framework (Composer) Aug 7, 2026
gr8man Credited to gr8man
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() Moderate
CVE-2026-63220 was published for codeigniter4/framework (Composer) Aug 7, 2026
gr8man Credited to gr8man
API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion) Moderate
CVE-2026-54164 was published for api-platform/core (Composer) Aug 7, 2026
alexandre-daubois Credited to alexandre-daubois
Smarty Security stream restriction bypass through stream: resource Moderate
CVE-2026-62996 was published for smarty/smarty (Composer) Aug 7, 2026
Faze-up Credited to Faze-up
Smarty: Symlink path traversal out of trusted directories Moderate
CVE-2026-62992 was published for smarty/smarty (Composer) Aug 7, 2026
Craft CMS: Passkey login accepts replayed WebAuthn assertions Critical
GHSA-wg23-69c2-gjc8 was published for craftcms/cms (Composer) Aug 7, 2026
Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts Moderate
CVE-2026-72779 was published for craftcms/cms (Composer) Aug 6, 2026
je-lv Credited to je-lv
Craft CMS: Authenticated leak of secret environment variables Moderate
CVE-2026-72782 was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element Moderate
CVE-2026-72785 was published for craftcms/cms (Composer) Aug 6, 2026
smakarim Credited to smakarim
Craft CMS: Missing authorization check allows non-admin control panel users access to user registration metrics Moderate
CVE-2026-14794 was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Incorrect path validation could potentially lead to path traversal Low
CVE-2026-72783 was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Stored XSS in the control panel via unescaped draft name Moderate
GHSA-2rp4-x2j7-qmcc was published for craftcms/cms (Composer) Aug 6, 2026
je-lv Credited to je-lv
PHP_CodeSniffer gitblame report command injection via crafted filename High
CVE-2026-67434 was published for squizlabs/php_codesniffer (Composer) Aug 6, 2026
Faze-up Credited to Faze-up, edorian, rodrigoprimo, and jrfnl edorian edorian
rodrigoprimo rodrigoprimo jrfnl jrfnl
Craft CMS: Arbitrary user password reset leading to administrator account takeover High
GHSA-p8x7-9vfw-p7vc was published for craftcms/cms (Composer) Aug 6, 2026
mHe4am Credited to mHe4am
Craft CMS: Authenticated RCE through Twig sandbox escape High
CVE-2026-72781 was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets Moderate
CVE-2026-14793 was published for craftcms/cms (Composer) Aug 6, 2026
Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass High
CVE-2026-72778 was published for craftcms/cms (Composer) Aug 6, 2026
saladin0x1 Credited to saladin0x1
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database