Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,479
Maven
5,000+
npm
5,000+
NuGet
886
pip
4,740
Pub
13
RubyGems
1,031
Rust
1,225
Swift
53
Unreviewed advisories
All unreviewed
5,000+

3,300 advisories

Loading
Ech0 Scope Bypass: profile:read Access Token Can Change Admin Password and Escalate to Unrestricted Session Moderate
GHSA-hm2h-wwwh-g49x was published for github.com/lin-snow/ech0 (Go) Apr 10, 2026
offset Credited to offset
PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands Moderate
GHSA-ffp3-3562-8cv3 was published for praisonaiagents (pip) Apr 10, 2026
offset Credited to offset
PraisonAI: Hardcoded `approval_mode="auto"` in Chainlit UI Overrides Administrator Configuration, Enabling Unapproved Shell Command Execution High
GHSA-qwgj-rrpj-75xm was published for PraisonAI (pip) Apr 10, 2026
offset Credited to offset
In systemd 259 before 260, there is local privilege escalation in systemd-machined because... Moderate Unreviewed
CVE-2026-40224 was published Apr 10, 2026
Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds Moderate
CVE-2026-40103 was published for code.vikunja.io/api (Go) Apr 10, 2026
alecclyde Credited to alecclyde
Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug Moderate
CVE-2026-35596 was published for code.vikunja.io/api (Go) Apr 10, 2026
adrgs Credited to adrgs and aisafe-bot aisafe-bot aisafe-bot
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to... Moderate Unreviewed
CVE-2026-2712 was published Apr 10, 2026
OpenStack Keystone: Restricted application credentials can create EC2 credentials Low
CVE-2026-33551 was published for keystone (pip) Apr 10, 2026
OpenClaw before 2026.3.25 contains an improper access control vulnerability in the HTTP /sessions... High Unreviewed
CVE-2026-34512 was published Apr 10, 2026
OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard Moderate
GHSA-cmfr-9m2r-xwhq was published for openclaw (npm) Apr 9, 2026
nicky-cc Credited to nicky-cc
OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing Moderate
GHSA-whf9-3hcx-gq54 was published for openclaw (npm) Apr 9, 2026
nicky-cc Credited to nicky-cc
GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9... Moderate Unreviewed
CVE-2026-2619 was published Apr 9, 2026
GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 18.8.9, 18.9... Moderate Unreviewed
CVE-2026-1752 was published Apr 9, 2026
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Privilege... High Unreviewed
CVE-2026-33461 was published Apr 8, 2026
Incorrect Authorization (CWE-863) in Kibana can lead to cross-space information disclosure via... Moderate Unreviewed
CVE-2026-33460 was published Apr 8, 2026
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions Moderate
GHSA-rfgh-63mg-8pwm was published for pyload-ng (pip) Apr 8, 2026
komi22 Credited to komi22
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields` Moderate
CVE-2026-39381 was published for parse-server (npm) Apr 8, 2026
offset Credited to offset and mtrezza mtrezza mtrezza
File Browser share links remain accessible after Share/Download permissions are revoked High
CVE-2026-35604 was published for github.com/filebrowser/filebrowser/v2 (Go) Apr 8, 2026
kodareef5 Credited to kodareef5
pyload-ng: Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng Moderate
CVE-2026-35586 was published for pyload-ng (pip) Apr 8, 2026
offset Credited to offset
OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in... High Unreviewed
CVE-2026-22682 was published Apr 7, 2026
OpenClaw: pnpm dlx approvals did not bind local script operands Moderate
GHSA-w6wx-jq6j-6mcj was published for openclaw (npm) Apr 7, 2026
Kazamayc Credited to Kazamayc
OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations Moderate
GHSA-fwjq-xwfj-gv75 was published for openclaw (npm) Apr 7, 2026
tdjackey Credited to tdjackey
OpenFGA's BatchCheck within-request deduplication produces incorrect authorization decisions via list-value cache-key collision Moderate
CVE-2026-34972 was published for github.com/openfga/openfga (Go) Apr 7, 2026
bugbunny-research Credited to bugbunny-research
An issue that allowed MCP agents to access remediation and asset information from outside of the... Moderate Unreviewed
CVE-2026-5374 was published Apr 7, 2026
An issue that could expose records outside of the authorized organization scope through the MCP... Low Unreviewed
CVE-2026-5382 was published Apr 7, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database