Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
4,963
Erlang
39
GitHub Actions
38
Go
2,615
Maven
5,000+
npm
4,255
NuGet
760
pip
4,036
Pub
12
RubyGems
953
Rust
1,049
Swift
45
Unreviewed advisories
All unreviewed
5,000+

162 advisories

Loading
On affected platforms, if SSH session multiplexing was configured on the client side, SSH... Moderate Unreviewed
CVE-2025-54547 was published Oct 30, 2025
Keycloak does not invalidate offline sessions when the offline_access scope is removed Moderate
CVE-2025-12110 was published for org.keycloak:keycloak-services (Maven) Oct 23, 2025
Keycloak does not invalidate sessions when "Remember Me" is disabled Moderate
CVE-2025-11429 was published for org.keycloak:keycloak-services (Maven) Oct 23, 2025
Strapi is vulnerable to Insufficient Session Expiration Moderate
CVE-2025-3930 was published for @strapi/strapi (npm) Oct 16, 2025
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2... Moderate Unreviewed
CVE-2025-25252 was published Oct 14, 2025
IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which... Moderate Unreviewed
CVE-2023-49881 was published Oct 1, 2025
Liferay Portal and DXP does not properly expire sessions Moderate
CVE-2025-43819 was published for com.liferay:com.liferay.saml.impl (Maven) Sep 24, 2025
cai0duque
Credited to cai0duque
Insufficient Session Expiration (CWE-613) in the Web Admin Panel in AxxonSoft Axxon One prior to... Moderate Unreviewed
CVE-2025-10223 was published Sep 10, 2025
Payload does not invalidate JWTs after log out Moderate
CVE-2025-4643 was published for @payloadcms/graphql (npm) Aug 29, 2025
IBM Aspera Faspex 5.0.0 through 5.0.12.1 could allow an authenticated user to perform... Moderate Unreviewed
CVE-2025-36040 was published Jul 31, 2025
An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4... Moderate Unreviewed
CVE-2024-27779 was published Jul 18, 2025
Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel... Moderate Unreviewed
CVE-2025-4407 was published Jun 30, 2025
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0,... Moderate Unreviewed
CVE-2024-50562 was published Jun 10, 2025
IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0... Moderate Unreviewed
CVE-2025-25019 was published Jun 3, 2025
IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could... Moderate Unreviewed
CVE-2025-33005 was published Jun 1, 2025
The TeleMessage service through 2025-05-05 implements authentication through a long-lived... Moderate Unreviewed
CVE-2025-48929 was published May 28, 2025
A suspended or recently logged-out user could continue to interact with Blueframe until the time... Moderate Unreviewed
CVE-2025-46741 was published May 12, 2025
A vulnerability was found in Dígitro NGC Explorer up to 3.44.15 and classified as problematic.... Moderate Unreviewed
CVE-2025-4528 was published May 11, 2025
Rack session gets restored after deletion Moderate
CVE-2025-46336 was published for rack-session (RubyGems) May 8, 2025
stengineering0 jeremyevans
ioquatix
Credited to stengineering0, jeremyevans, and ioquatix
Rack session gets restored after deletion Moderate
CVE-2025-32441 was published for rack (RubyGems) May 8, 2025
stengineering0 jeremyevans
ioquatix
Credited to stengineering0, jeremyevans, and ioquatix
Auth0 NextJS SDK v4 Missing Session Invalidation Moderate
CVE-2025-46344 was published for @auth0/nextjs-auth0 (npm) Apr 29, 2025
IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow... Moderate Unreviewed
CVE-2024-22351 was published Apr 24, 2025
IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session... Moderate Unreviewed
CVE-2024-45651 was published Apr 18, 2025
IBM Robotic Process Automation and Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7... Moderate Unreviewed
CVE-2024-49825 was published Apr 14, 2025
IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could... Moderate Unreviewed
CVE-2024-25051 was published Apr 2, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database