Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,624
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

44,650 advisories

Loading
A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of... Low Unreviewed
CVE-2026-84438 was published Sep 2, 2026
A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown... Low Unreviewed
CVE-2026-84437 was published Sep 2, 2026
NocoBase fails to sanitize rich text field values in the read renderer, allowing users with... Moderate Unreviewed
CVE-2026-84701 was published Sep 2, 2026
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing... Critical Unreviewed
CVE-2026-84695 was published Sep 2, 2026
AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization,... Moderate Unreviewed
CVE-2026-84477 was published Sep 2, 2026
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that... Moderate Unreviewed
CVE-2026-73524 was published Sep 1, 2026
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass Moderate
CVE-2026-84371 was published for sanitize-html (npm) Sep 1, 2026
koyokr Credited to koyokr
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed High
GHSA-f8fg-pg57-v4j8 was published for league/commonmark (Composer) Sep 1, 2026
StarPlatinu Credited to StarPlatinu
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes Moderate
CVE-2026-58191 was published for @appium/base-driver (npm) Sep 1, 2026
nikkoenggaliano Credited to nikkoenggaliano
A flaw was found in pulpcore's content serving application. Files uploaded to Pulp file-type... Moderate Unreviewed
CVE-2026-84232 was published Sep 1, 2026
The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... Moderate Unreviewed
CVE-2026-7877 was published Sep 1, 2026
Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS... Moderate Unreviewed
CVE-2026-19471 was published Sep 1, 2026
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP... Moderate Unreviewed
CVE-2026-84193 was published Sep 1, 2026
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP... High Unreviewed
CVE-2026-84192 was published Sep 1, 2026
LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the... Moderate Unreviewed
CVE-2026-84188 was published Sep 1, 2026
LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages... Moderate Unreviewed
CVE-2026-84191 was published Sep 1, 2026
LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by... Critical Unreviewed
CVE-2026-84189 was published Sep 1, 2026
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored... Moderate Unreviewed
CVE-2026-16788 was published Sep 1, 2026
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored... Moderate Unreviewed
CVE-2026-16786 was published Sep 1, 2026
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... Moderate Unreviewed
CVE-2026-15101 was published Sep 1, 2026
The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ... High Unreviewed
CVE-2026-19914 was published Sep 1, 2026
The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ... Moderate Unreviewed
CVE-2026-18488 was published Sep 1, 2026
The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for... Moderate Unreviewed
CVE-2026-75980 was published Sep 1, 2026
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor... Moderate Unreviewed
CVE-2026-75964 was published Sep 1, 2026
The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored... Moderate Unreviewed
CVE-2026-16787 was published Sep 1, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database