GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
6 advisories
Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsers
Moderate
CVE-2026-39964
was published
for
@typebot.io/js
(npm)
May 26, 2026
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
Moderate
CVE-2026-39960
was published
for
mantisbt/mantisbt
(Composer)
May 11, 2026
Open WebUI has Stored XSS in Pending User Overlay via Incorrect DOMPurify Application Order
Moderate
CVE-2026-44568
was published
for
open-webui
(pip)
May 8, 2026
Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values
Moderate
CVE-2026-35588
was published
for
glances
(pip)
Apr 21, 2026
rhukster/dom-sanitizer: SVG <style> tag allows CSS injection via unfiltered url() and @import directives
Moderate
CVE-2026-40301
was published
for
rhukster/dom-sanitizer
(Composer)
Apr 10, 2026
Invoice Ninja Denylist Bypass may Lead to Stored XSS via Invoice Line Items
Moderate
CVE-2026-33628
was published
for
invoiceninja/invoiceninja
(Composer)
Mar 24, 2026
ProTip!
Advisories are also available from the
GraphQL API