Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,608
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

8 advisories

Loading
praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap) High
CVE-2026-55524 was published for praisonaiagents (pip) Aug 25, 2026
sour-exploit Credited to sour-exploit
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False Moderate
CVE-2026-71322 was published for lemur (pip) Aug 18, 2026
sour-exploit Credited to sour-exploit
swift-nio-http2: Missing CR/LF/NUL validation in header values Moderate
CVE-2026-64785 was published for swift-nio-http2 (Swift) Jul 24, 2026
sour-exploit Credited to sour-exploit
Lemur user-update path stores plaintext passwords Moderate
CVE-2026-55164 was published for lemur (pip) Jun 25, 2026
sour-exploit Credited to sour-exploit
Lemur Privilege Escalation: Non-admin role members can rewrite role membership via PUT /api/1/roles/<id> Moderate
CVE-2026-55163 was published for lemur (pip) Jun 25, 2026
sour-exploit Credited to sour-exploit
Lemur: Crafted CRL/OCSP URLs in uploaded certificates lead to post-authentication SSRF Moderate
CVE-2026-55162 was published for lemur (pip) Jun 25, 2026
sour-exploit Credited to sour-exploit
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) High
CVE-2026-57122 was published for praisonai (pip) Jun 18, 2026
sour-exploit Credited to sour-exploit
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in Critical
CVE-2026-57123 was published for praisonaiagents (pip) Jun 18, 2026
sour-exploit Credited to sour-exploit
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database