GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
Language support
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.
Filter advisories
Filter advisories
GitHub reviewed advisories
All reviewed
5,000+
Composer
3,968
Erlang
29
GitHub Actions
16
Go
1,752
Maven
4,982
npm
3,516
NuGet
609
pip
3,090
Pub
10
RubyGems
832
Rust
782
Swift
34
Unreviewed advisories
All unreviewed
5,000+
8,644 advisories
Filter by severity
Bitbucket OAuth access token exposed in the build log by Bitbucket Branch Source Plugin
Moderate
CVE-2024-39460
was published
for
org.jenkins-ci.plugins:cloudbees-bitbucket-branch-source
(Maven)
Jun 26, 2024
Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin
Moderate
CVE-2024-39459
was published
for
org.jenkins-ci.plugins:plain-credentials
(Maven)
Jun 26, 2024
Cross-site Scripting in ZenUML
Moderate
CVE-2024-38527
was published
for
@zenuml/core
(npm)
Jun 26, 2024
@fastly/js-compute has a use-after-free in some host call implementations
Moderate
CVE-2024-38375
was published
for
@fastly/js-compute
(npm)
Jun 26, 2024
Panic when parsing invalid palette-color images in golang.org/x/image
Moderate
CVE-2024-24792
was published
for
golang.org/x/image
(Go)
Jun 26, 2024
Directory creation by malicious user in saltstack
Moderate
CVE-2024-22231
was published
for
salt
(pip)
Jun 27, 2024
litellm vulnerable to improper access control in team management
Moderate
CVE-2024-5710
was published
for
litellm
(pip)
Jun 27, 2024
CometBFT is unstability during blocksync when syncing from malicious peer
Moderate
GHSA-hg58-rf2h-6rr7
was published
for
github.com/cometbft/cometbft
(Go)
Jun 28, 2024
Gin mishandles a wildcard at the end of an origin string
Moderate
CVE-2019-25211
was published
for
github.com/gin-gonic/gin
(Go)
Jun 29, 2024
Reflected Cross-Site Scripting (XSS) in zenml
Moderate
CVE-2024-5062
was published
for
zenml
(pip)
Jun 30, 2024
frappejs was discovered to contain a prototype pollution via the function registerView
Moderate
CVE-2024-38992
was published
for
@airvertco/frappejs
(npm)
Jul 1, 2024
akbr patch-into was discovered to contain a prototype pollution via the function patchInto
Moderate
CVE-2024-38991
was published
for
@akbr/patch-into
(npm)
Jul 1, 2024
jsonic was discovered to contain a prototype pollution via the function empty.
Moderate
CVE-2024-38993
was published
for
jsonic
(npm)
Jul 1, 2024
@amoy/common v was discovered to contain a prototype pollution via the function extend
Moderate
CVE-2024-38994
was published
for
@amoy/common
(npm)
Jul 1, 2024
ag-grid-community were discovered to contain a prototype pollution via the _.mergeDeep function
Moderate
CVE-2024-38996
was published
for
ag-grid-community
(npm)
Jul 1, 2024
adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults
Moderate
CVE-2024-38997
was published
for
@adolph_dudu/ratio-swiper
(npm)
Jul 1, 2024
GeoServer's Server Status shows sensitive environmental variables and Java properties
Moderate
CVE-2024-34696
was published
for
org.geoserver.web:gs-web-app
(Maven)
Jul 1, 2024
Weblate vulnerable to improper sanitization of project backups
Moderate
CVE-2024-39303
was published
for
Weblate
(pip)
Jul 1, 2024
Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py
Moderate
CVE-2024-39236
was published
for
Gradio
(pip)
Jul 1, 2024
ProTip!
Advisories are also available from the
GraphQL API