豆豆友情提示：这是一个非官方 GitHub 代理镜像，主要用于网络测试或访问加速。请勿在此进行登录、注册或处理任何敏感信息。进行这些操作请务必访问官方网站 github.com。 Raw 内容也通过此代理提供。
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,549
Maven
5,000+
npm
5,000+
NuGet
917
pip
4,798
Pub
13
RubyGems
1,038
Rust
1,237
Swift
53
Unreviewed advisories
All unreviewed
5,000+

2,143 advisories

Loading
Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy... High Unreviewed
CVE-2026-34428 was published Apr 20, 2026
A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown... Moderate Unreviewed
CVE-2026-6649 was published Apr 20, 2026
A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this... Moderate Unreviewed
CVE-2026-6625 was published Apr 20, 2026
A flaw has been found in langgenius dify up to 1.13.3. This issue affects the function... Moderate Unreviewed
CVE-2026-6618 was published Apr 20, 2026
A vulnerability was detected in langgenius dify up to 0.6.9. This vulnerability affects the... Moderate Unreviewed
CVE-2026-6617 was published Apr 20, 2026
A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This... Moderate Unreviewed
CVE-2026-6616 was published Apr 20, 2026
A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects... Moderate Unreviewed
CVE-2026-6606 was published Apr 20, 2026
A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the... Moderate Unreviewed
CVE-2026-6605 was published Apr 20, 2026
A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is... Moderate Unreviewed
CVE-2026-6604 was published Apr 20, 2026
A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is... Moderate Unreviewed
CVE-2026-6587 was published Apr 20, 2026
A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app... Moderate Unreviewed
CVE-2026-6573 was published Apr 19, 2026
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets Moderate
GHSA-f7fh-qg34-x2xh was published for openclaw (npm) Apr 17, 2026
nicky-cc Credited to nicky-cc
OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage Moderate
GHSA-536q-mj95-h29h was published for openclaw (npm) Apr 17, 2026
zsxsoft Credited to zsxsoft, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement Moderate
GHSA-527m-976r-jf79 was published for openclaw (npm) Apr 17, 2026
zsxsoft Credited to zsxsoft, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenClaw: Browser tabs action select and close routes bypassed SSRF policy Moderate
GHSA-rj2p-j66c-mgqh was published for openclaw (npm) Apr 17, 2026
nicky-cc Credited to nicky-cc
OpenClaw: Browser SSRF policy default allowed private-network navigation Moderate
GHSA-53vx-pmqw-863c was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding Moderate
GHSA-xq94-r468-qwgj was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes Moderate
GHSA-2767-2q9v-9326 was published for openclaw (npm) Apr 17, 2026
threalwinky Credited to threalwinky
OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation Moderate
GHSA-c4qm-58hj-j6pj was published for openclaw (npm) Apr 17, 2026
zsxsoft Credited to zsxsoft, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the... High Unreviewed
CVE-2026-40516 was published Apr 17, 2026
A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this... Moderate Unreviewed
CVE-2026-6497 was published Apr 17, 2026
Craftql vulnerable to Server-Side Request Forgery Moderate
CVE-2026-31317 was published for markhuot/craftql (Composer) Apr 17, 2026
GREENmod uses named pipes for communication between plugins, the web portal, and the system... Moderate Unreviewed
CVE-2026-5131 was published Apr 17, 2026
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS Moderate
CVE-2026-5052 was published for github.com/hashicorp/vault (Go) Apr 17, 2026
langchain-openai: Image token counting SSRF protection can be bypassed via DNS rebinding Low
GHSA-r7w7-9xr2-qq2r was published for langchain-openai (pip) Apr 16, 2026
deprrous Credited to deprrous
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database