Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,636
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,529
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

44,695 advisories

Loading
DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials) Moderate
CVE-2026-68921 was published for @dicebear/core (npm) Sep 2, 2026
rz1027 Credited to rz1027
SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting... Moderate Unreviewed
CVE-2026-75134 was published Sep 2, 2026
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin... High Unreviewed
CVE-2026-84673 was published Sep 2, 2026
Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names,... Moderate Unreviewed
CVE-2026-84677 was published Sep 2, 2026
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard... High Unreviewed
CVE-2026-84665 was published Sep 2, 2026
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log... High Unreviewed
CVE-2026-84648 was published Sep 2, 2026
The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content... Moderate Unreviewed
CVE-2026-82884 was published Sep 2, 2026
The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets'... Moderate Unreviewed
CVE-2026-83547 was published Sep 2, 2026
The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its... Moderate Unreviewed
CVE-2024-3773 was published Sep 2, 2026
The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description... Low Unreviewed
CVE-2025-15692 was published Sep 2, 2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")... Moderate Unreviewed
CVE-2026-81201 was published Sep 2, 2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")... Moderate Unreviewed
CVE-2026-81167 was published Sep 2, 2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")... Moderate Unreviewed
CVE-2026-81160 was published Sep 2, 2026
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. High Unreviewed
CVE-2026-76782 was published Sep 2, 2026
Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. High Unreviewed
CVE-2026-76759 was published Sep 2, 2026
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")... Moderate Unreviewed
CVE-2026-18986 was published Sep 2, 2026
Sulu: Stored XSS via media download inline-disposition override Moderate
CVE-2026-82396 was published for sulu/sulu (Composer) Sep 2, 2026
0x3xP01t3r Credited to 0x3xP01t3r
Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes Moderate
GHSA-cp6q-959q-f8rh was published for @tiptap/core (npm) Sep 2, 2026
joostgrunwald Credited to joostgrunwald
Livewire DOM-based cross-site scripting during client-side state handling Moderate
CVE-2026-81887 was published for livewire/livewire (Composer) Sep 2, 2026
Vagebondcur Credited to Vagebondcur and MelvinTh17 MelvinTh17 MelvinTh17
SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to... High Unreviewed
CVE-2026-84803 was published Sep 2, 2026
Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions. Moderate Unreviewed
CVE-2026-83562 was published Sep 2, 2026
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions. Moderate Unreviewed
CVE-2026-84781 was published Sep 2, 2026
Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting... Moderate Unreviewed
CVE-2026-84793 was published Sep 2, 2026
Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. High Unreviewed
CVE-2026-81771 was published Sep 2, 2026
Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. High Unreviewed
CVE-2026-81775 was published Sep 2, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database