Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
101
GitHub Actions
54
Go
4,295
Maven
5,000+
npm
5,000+
NuGet
1,029
pip
5,000+
Pub
13
RubyGems
1,107
Rust
1,492
Swift
61
Unreviewed advisories
All unreviewed
5,000+

195 advisories

Loading
9router: Login brute-force protection bypass via spoofed X-Forwarded-For header High
CVE-2026-55501 was published for 9router (npm) Jul 6, 2026
dinhvaren Credited to dinhvaren
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING High
CVE-2026-49353 was published for 9router (npm) Jul 2, 2026
SnailSploit Credited to SnailSploit and 0xShemesh 0xShemesh 0xShemesh
OpenClaw: Matrix allowFrom could bind to mutable display names High
CVE-2026-53811 was published for openclaw (npm) Jul 2, 2026
PhilipPhil Credited to PhilipPhil
OpenClaw: Slack allowFrom could bind to mutable display names High
GHSA-c29c-2q9c-pc86 was published for openclaw (npm) Jul 2, 2026
PhilipPhil Credited to PhilipPhil
OpenClaw: Control UI locality spoofing could mint a durable admin device token High
CVE-2026-53817 was published for openclaw (npm) Jul 2, 2026
cantinagen Credited to cantinagen
OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers High
GHSA-rggc-m335-3wvj was published for openclaw (npm) Jul 2, 2026
cantinagen Credited to cantinagen and Ellahinator Ellahinator Ellahinator
NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated... High Unreviewed
CVE-2026-58593 was published Jul 1, 2026
FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path... High Unreviewed
CVE-2026-13207 was published Jun 30, 2026
chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header High
GHSA-rjr7-jggh-pgcp was published for github.com/go-chi/chi/middleware (Go) Jun 25, 2026
rezmoss Credited to rezmoss
Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers High
CVE-2026-25119 was published for gogs.io/gogs (Go) Jun 22, 2026
tenbbughunters Credited to tenbbughunters
Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely... High Unreviewed
CVE-2026-39999 was published Jun 19, 2026
OpenClaw: Discord allowFrom could bind to mutable display names High
CVE-2026-53849 was published for openclaw (npm) Jun 18, 2026
PhilipPhil Credited to PhilipPhil
OpenClaw: Zalo allowFrom could bind to mutable display names High
CVE-2026-53857 was published for openclaw (npm) Jun 18, 2026
PhilipPhil Credited to PhilipPhil
Heimdall: IP Spoofing via Unvalidated Forwarding Headers High
GHSA-38x9-25wx-7fg2 was published for https://github.com/dadrus/heimdall (Go) Jun 18, 2026
Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header... High Unreviewed
CVE-2026-55202 was published Jun 17, 2026
Duplicate Advisory: Zalo allowFrom could bind to mutable display names High
GHSA-w7m7-3xcf-mp48 was published for openclaw (npm) Jun 16, 2026 • withdrawn
Duplicate Advisory: Discord allowFrom could bind to mutable display names High
GHSA-p44v-rx83-vjp4 was published for openclaw (npm) Jun 16, 2026 • withdrawn
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` High
CVE-2026-52845 was published for github.com/caddyserver/caddy (Go) Jun 16, 2026
Vincent550102 Credited to Vincent550102
Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions. High Unreviewed
CVE-2026-27089 was published Jun 15, 2026
OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local... High Unreviewed
CVE-2026-53832 was published Jun 13, 2026
OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming... High Unreviewed
CVE-2026-53833 was published Jun 13, 2026
OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature... High Unreviewed
CVE-2026-53823 was published Jun 13, 2026
A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could... High Unreviewed
CVE-2026-6090 was published Jun 10, 2026
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections High
CVE-2026-47737 was published for puma (RubyGems) Jun 9, 2026
vxhex Credited to vxhex and nateberkopec nateberkopec nateberkopec
Authentication Bypass by Spoofing vulnerability in AAM Plugin Advanced Access Manager allows URL... High Unreviewed
CVE-2026-42674 was published Jun 1, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database