Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
4,825
Erlang
36
GitHub Actions
32
Go
2,417
Maven
5,000+
npm
4,054
NuGet
723
pip
3,845
Pub
12
RubyGems
933
Rust
1,005
Swift
38
Unreviewed advisories
All unreviewed
5,000+

23,393 advisories

Loading
Twisted vulnerable to HTTP Request Smuggling Attacks Moderate
GHSA-8r99-h8j2-rw64 was published for twisted (pip) Oct 7, 2022
Flask-Security vulnerable to Open Redirect Moderate
CVE-2021-23385 was published for Flask-Security (pip) Oct 7, 2022
Blst vulnerable to incorrect results for some inputs in blst_fp_eucl_inverse function Moderate
GHSA-x279-68rr-jp4p was published for github.com/supranational/blst (Go) Oct 7, 2022
guidovranken
Tendermint Core vulnerable to Uncontrolled Resource Consumption Moderate
CVE-2021-21271 was published for github.com/tendermint/tendermint (Go) Oct 7, 2022
cmwaters melekes
cyril-crypto brianatcrypto tomtau yihuang
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching High
CVE-2020-26269 was published for tensorflow (pip) Oct 7, 2022
gajira-create GitHub action vulnerable to arbitrary code execution Critical
CVE-2020-14188 was published for atlassian/gajira-create (GitHub Actions) Oct 7, 2022
JarLob
xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service High
CVE-2020-25614 was published for github.com/antchfx/xmlquery (Go) Oct 7, 2022
anonymous-nlp-student
goxmldsig vulnerable to crash on nil-pointer dereference caused by sending malformed XML signatures High
CVE-2020-7711 was published for github.com/russellhaering/gosaml2 (Go) Oct 7, 2022
etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery Low
GHSA-9gp7-6833-wv89 was published for go.etcd.io/etcd/client/v3 (Go) Oct 6, 2022
etcd user credentials are stored in WAL logs in plaintext Low
GHSA-528j-9r78-wffx was published for go.etcd.io/etcd/client/v3 (Go) Oct 6, 2022
tdunlap607
etcd has no minimum password length Moderate
CVE-2020-15115 was published for go.etcd.io/etcd/client/v3 (Go) Oct 6, 2022
etcd vulnerable to TOCTOU of gateway endpoint authentication Low
GHSA-h8g9-6gvh-5mrc was published for go.etcd.io/etcd/v3 (Go) Oct 6, 2022
etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic Moderate
CVE-2020-15112 was published for go.etcd.io/etcd/v3 (Go) Oct 6, 2022
Caddy vulnerable to Authentication Bypass due to mishandling of TLS client authentication Critical
CVE-2018-21246 was published for github.com/caddyserver/caddy (Go) Oct 6, 2022
generator-jhipster vulnerable to login check Regular Expression Denial of Service High
GHSA-8w7w-67mw-r5p7 was published for generator-jhipster (npm) Oct 6, 2022
PHPMailer vulnerable to email header injection High
CVE-2012-0796 was published for phpmailer/phpmailer (Composer) Oct 6, 2022
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued Low
CVE-2022-39284 was published for codeigniter4/framework (Composer) Oct 6, 2022
SIF's Digital Signature Hash Algorithms Not Validated Moderate
CVE-2022-39237 was published for github.com/sylabs/sif/v2 (Go) Oct 6, 2022
tri-adam
kamadak-exif vulnerable to Infinite loop when parsing PNG files Moderate
CVE-2021-21235 was published for kamadak-exif (Rust) Oct 6, 2022
TCPDF vulnerable to attackers triggering deserialization of arbitrary data Critical
CVE-2018-17057 was published for fooman/tcpdf (Composer) Oct 6, 2022
Withdrawn: CVE Rejected: JXPath vulnerable to remote code execution when interpreting untrusted XPath expressions Critical
CVE-2022-41852 was published for commons-jxpath:commons-jxpath (Maven) Oct 6, 2022 • withdrawn
Warxim JPLachance
HyperSQL DataBase vulnerable to remote code execution when processing untrusted input Critical
CVE-2022-41853 was published for org.hsqldb:hsqldb (Maven) Oct 6, 2022
lukaseder
JXPath Out-of-bounds Write vulnerability Moderate
CVE-2022-40158 was published for commons-jxpath:commons-jxpath (Maven) Oct 6, 2022 • withdrawn
JXPath Out-of-bounds Write vulnerability Moderate
CVE-2022-40157 was published for commons-jxpath:commons-jxpath (Maven) Oct 6, 2022 • withdrawn
JXPath Out-of-bounds Write vulnerability Moderate
CVE-2022-40161 was published for commons-jxpath:commons-jxpath (Maven) Oct 6, 2022 • withdrawn
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database