豆豆友情提示：这是一个非官方 GitHub 代理镜像，主要用于网络测试或访问加速。请勿在此进行登录、注册或处理任何敏感信息。进行这些操作请务必访问官方网站 github.com。 Raw 内容也通过此代理提供。
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,549
Maven
5,000+
npm
5,000+
NuGet
917
pip
4,798
Pub
13
RubyGems
1,038
Rust
1,237
Swift
53
Unreviewed advisories
All unreviewed
5,000+

210 advisories

Loading
Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC... High Unreviewed
CVE-2026-32965 was published Apr 20, 2026
OpenClaw: Feishu webhook and card-action validation now fail closed Critical
GHSA-xh72-v6v9-mwhc was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
OpenClaw: Browser SSRF policy default allowed private-network navigation Moderate
GHSA-53vx-pmqw-863c was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass Critical
GHSA-68qg-g8mg-6pr7 was published for @paperclipai/server (npm) Apr 10, 2026
sagilayani Credited to sagilayani
OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default... Critical Unreviewed
CVE-2026-28205 was published Apr 9, 2026
openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools Moderate
CVE-2026-39398 was published for openclaw-claude-bridge (npm) Apr 8, 2026
Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist Critical
CVE-2026-31818 was published for @budibase/backend-core (npm) Apr 3, 2026
Moonster8282 Credited to Moonster8282
Electron: Context Isolation bypass via contextBridge VideoFrame transfer High
CVE-2026-34780 was published for electron (npm) Apr 3, 2026
DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost High
CVE-2026-34742 was published for github.com/modelcontextprotocol/go-sdk (Go) Apr 1, 2026
JLLeitschuh Credited to JLLeitschuh
NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an... High Unreviewed
CVE-2026-24148 was published Mar 31, 2026
Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability Moderate
GHSA-q94v-v6m9-jhq9 was published for openclaw (npm) Mar 21, 2026 • withdrawn
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection High
CVE-2026-31975 was published for @siteboon/claude-code-ui (npm) Mar 11, 2026
Ethan-Yang-opcia Credited to Ethan-Yang-opcia, DhiyaneshGeek, and neo-ai-engineer DhiyaneshGeek DhiyaneshGeek
neo-ai-engineer neo-ai-engineer
AMPPS 2.7 contains a denial of service vulnerability that allows remote attackers to crash the... High Unreviewed
CVE-2018-25169 was published Mar 6, 2026
Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers... High Unreviewed
CVE-2018-25193 was published Mar 6, 2026
Microsoft ACI Confidential Containers Information Disclosure Vulnerability Moderate Unreviewed
CVE-2026-26122 was published Mar 6, 2026
An unauthenticated Remote Code Execution (RCE) vulnerability exists in the SNMP service of... Critical Unreviewed
CVE-2026-28775 was published Mar 4, 2026
UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default... Critical Unreviewed
CVE-2025-70998 was published Feb 18, 2026
A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of... Moderate Unreviewed
CVE-2026-2617 was published Feb 17, 2026
Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise Critical
CVE-2026-26190 was published for github.com/milvus-io/milvus (Go) Feb 11, 2026
0x1f Credited to 0x1f
The Advanced Country Blocker plugin for WordPress is vulnerable to Authorization Bypass in all... Moderate Unreviewed
CVE-2026-1675 was published Feb 7, 2026
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration Critical
CVE-2026-25894 was published for fuxa-server (npm) Feb 5, 2026
wodzen Credited to wodzen
FUXA contains an insecure default configuration vulnerability High
CVE-2025-69970 was published for fuxa-server (npm) Feb 3, 2026
terraform-provider-proxmox has insecure sudo recommendation in the documentation High
CVE-2026-25499 was published for github.com/bpg/terraform-provider-proxmox (Go) Feb 2, 2026
lucasmaurice Credited to lucasmaurice
Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer Critical
CVE-2025-62877 was published for github.com/harvester/harvester-installer (Go) Jan 5, 2026
Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin... Critical Unreviewed
CVE-2025-56332 was published Dec 30, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database