Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
102
GitHub Actions
54
Go
4,428
Maven
5,000+
npm
5,000+
NuGet
1,088
pip
5,000+
Pub
13
RubyGems
1,129
Rust
1,506
Swift
62
Unreviewed advisories
All unreviewed
5,000+

30 advisories

Loading
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys High
GHSA-jv2h-4p9v-wf5w was published for ouroboros-ai (pip) Jun 19, 2026
hackkim Credited to hackkim and matte1782 matte1782 matte1782
Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action` Critical
CVE-2026-45087 was published for github.com/hahwul/dalfox/v2 (Go) May 12, 2026
drmingler Credited to drmingler
OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests Moderate
CVE-2026-44992 was published for openclaw (npm) Apr 25, 2026
nexrin Credited to nexrin
OpenClaw: Workspace .env could inject OpenClaw runtime-control variables Moderate
CVE-2026-43531 was published for openclaw (npm) Apr 17, 2026
zsxsoft Credited to zsxsoft and KeenSecurityLab KeenSecurityLab KeenSecurityLab
Spring Cloud Gateway's SSL bundle configuration silently bypassed High
CVE-2026-22750 was published for org.springframework.cloud:spring-cloud-gateway (Maven) Apr 10, 2026
scottfrederick Credited to scottfrederick
OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config High
CVE-2026-41384 was published for openclaw (npm) Apr 7, 2026
YLChen-007 Credited to YLChen-007
OpenClaw: Workspace `.env` can override the bundled plugin trust root High
CVE-2026-41396 was published for openclaw (npm) Apr 3, 2026
nexrin Credited to nexrin, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code High
CVE-2026-41336 was published for openclaw (npm) Apr 2, 2026
nexrin Credited to nexrin, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenClaw has Inconsistent Host Exec Environment Override Sanitization High
CVE-2026-35650 was published for openclaw (npm) Mar 26, 2026
zpbrent Credited to zpbrent
RSSN has Arbitrary Code Execution via Unvalidated JIT Instruction Generation in C-FFI Interface Critical
CVE-2026-30960 was published for rssn (Rust) Mar 10, 2026
panayang Credited to panayang
OpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots Moderate
GHSA-j425-whc4-4jgc was published for openclaw (npm) Mar 9, 2026
tdjackey Credited to tdjackey, SnailSploit, and zpbrent SnailSploit SnailSploit
zpbrent zpbrent
OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class) High
CVE-2026-32056 was published for openclaw (npm) Mar 3, 2026
tdjackey Credited to tdjackey
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands High
GHSA-w9cg-v44m-4qv8 was published for openclaw (npm) Mar 3, 2026
tdjackey Credited to tdjackey
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths Moderate
GHSA-5h2c-8v84-qpvr was published for openclaw (npm) Mar 3, 2026
tdjackey Credited to tdjackey
OpenClaw's config env vars allowed startup env injection into service runtime Moderate
CVE-2026-22177 was published for openclaw (npm) Mar 3, 2026
tdjackey Credited to tdjackey
OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints Moderate
CVE-2026-22169 was published for openclaw (npm) Mar 3, 2026
tdjackey Credited to tdjackey
OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE) High
CVE-2026-32003 was published for openclaw (npm) Mar 3, 2026
tdjackey Credited to tdjackey
OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows Low
CVE-2026-32058 was published for openclaw (npm) Mar 2, 2026
tdjackey Credited to tdjackey
OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth) Moderate
CVE-2026-4039 was published for openclaw (npm) Feb 27, 2026
nedlir Credited to nedlir
eBay API MCP Server Affected by Environment Variable Injection High
CVE-2026-27203 was published for ebay-mcp (npm) Feb 19, 2026
nedlir Credited to nedlir
Taguette password reset link poisoning High
CVE-2025-62527 was published for taguette (pip) Oct 20, 2025
emilvirkki Credited to emilvirkki
Liferay Portal has External Control of System or Configuration Settings Low
CVE-2025-43792 was published for com.liferay.portal:com.liferay.portal.kernel (Maven) Sep 15, 2025
Netavark Has Possible DNS Resolve Confusion Low
CVE-2025-8283 was published for netavark (Rust) Jul 28, 2025
ingress-nginx controller - configuration injection via unsanitized mirror annotations High
CVE-2025-1098 was published for k8s.io/ingress-nginx (Go) Mar 25, 2025
dor-hayun Credited to dor-hayun
ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation High
CVE-2025-1097 was published for k8s.io/ingress-nginx (Go) Mar 25, 2025
dor-hayun Credited to dor-hayun
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database