Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,455
Maven
5,000+
npm
5,000+
NuGet
1,090
pip
5,000+
Pub
13
RubyGems
1,135
Rust
1,509
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

741 advisories

Loading
The web management interface in  Tycon Systems TPDIN-Monitor-WEB2 stores and displays system... Moderate Unreviewed
CVE-2026-55985 was published Jul 25, 2026
Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell... Moderate Unreviewed
CVE-2026-16802 was published Jul 24, 2026
Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to... High Unreviewed
CVE-2024-58023 was published Jul 23, 2026
n8n: Google Service Account Private Key Exposed in JWT Header Moderate
CVE-2026-65599 was published for n8n (npm) Jul 22, 2026
sladkani Credited to sladkani
Duplicate Advisory: Google Service Account Private Key Exposed in JWT Header Moderate
GHSA-mhvh-gwhr-76pw was published for n8n (npm) Jul 22, 2026 • withdrawn
Malayke Credited to Malayke
nebula-mesh: Operator session tokens stored in plaintext in the database High
CVE-2026-53603 was published for github.com/forgekeep/nebula-mesh (Go) Jul 14, 2026
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does... Moderate Unreviewed
CVE-2026-8804 was published Jul 3, 2026
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted Moderate
CVE-2026-50267 was published for Steeltoe.Configuration.Abstractions (NuGet) Jul 2, 2026
Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr... Moderate Unreviewed
CVE-2026-38571 was published Jun 27, 2026
Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the... Moderate Unreviewed
CVE-2026-57287 was published Jun 24, 2026
nebula-mesh's stores enrollment tokens unhashed in SQLite Moderate
GHSA-ghmh-jhmj-wcmf was published for github.com/juev/nebula-mesh (Go) Jun 22, 2026
ak2k Credited to ak2k
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets Moderate
CVE-2026-55885 was published for getgrav/grav (Composer) Jun 18, 2026
nicl4ssic Credited to nicl4ssic
Improper access control in the ticketing integration settings in Devolutions Server allows an... Moderate Unreviewed
CVE-2026-10786 was published Jun 8, 2026
GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in... High Unreviewed
CVE-2026-36176 was published Jun 4, 2026
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows... Low Unreviewed
CVE-2026-4387 was published May 29, 2026
This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive... Moderate Unreviewed
CVE-2026-9274 was published May 26, 2026
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path High
CVE-2026-8596 was published for sagemaker (pip) May 21, 2026
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the... Moderate Unreviewed
CVE-2026-6332 was published May 14, 2026
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh)... Moderate Unreviewed
CVE-2026-42408 was published May 13, 2026
When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST... Moderate Unreviewed
CVE-2026-28758 was published May 13, 2026
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file. Low Unreviewed
CVE-2026-45362 was published May 12, 2026
Electerm's full process.env exposed to renderer via window.pre.env Moderate
CVE-2026-43942 was published for electerm (npm) May 8, 2026
osageling Credited to osageling
Flowise: Bcrypt Password Hash Exposure Moderate
CVE-2026-8026 was published for flowise (npm) May 6, 2026
Prometheus Azure AD remote write OAuth client secret exposed via config API High
CVE-2026-42151 was published for github.com/prometheus/prometheus (Go) May 5, 2026
brettgervasoni Credited to brettgervasoni
In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext... High Unreviewed
CVE-2026-43824 was published May 2, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database