Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
40
GitHub Actions
38
Go
2,927
Maven
5,000+
npm
4,583
NuGet
786
pip
4,292
Pub
12
RubyGems
979
Rust
1,113
Swift
49
Unreviewed advisories
All unreviewed
5,000+

12 advisories

Loading
Alist vulnerable to Path Traversal in multiple file operation handlers High
CVE-2026-25161 was published for github.com/alist-org/alist/v3 (Go) Feb 4, 2026
XlabAITeam A7um
okatu-loli
Credited to XlabAITeam, A7um, and okatu-loli
Alist has Insecure TLS Config Critical
CVE-2026-25160 was published for github.com/alist-org/alist/v3 (Go) Feb 4, 2026
XlabAITeam A7um
okatu-loli
Credited to XlabAITeam, A7um, and okatu-loli
OpenList has Insecure TLS Default Configuration High
CVE-2026-25060 was published for github.com/OpenListTeam/OpenList/v4 (Go) Feb 2, 2026
XlabAITeam dezhishen
KirCute jyxjjj A7um pkuGenuine keenanwgn
Credited to XlabAITeam, dezhishen, KirCute, jyxjjj, A7um, pkuGenuine, and keenanwgn
OpenList vulnerable to Path Traversal in file copy and remove handlers High
CVE-2026-25059 was published for github.com/OpenListTeam/OpenList/v4 (Go) Feb 2, 2026
XlabAITeam KirCute
dezhishen Suyunmeng jyxjjj A7um pkuGenuine keenanwgn
Credited to XlabAITeam, KirCute, dezhishen, Suyunmeng, jyxjjj, A7um, pkuGenuine, and keenanwgn
sm-crypto Affected by Signature Forgery in SM2-DSA High
CVE-2026-23965 was published for sm-crypto (npm) Jan 21, 2026
XlabAITeam A7um
tl2cents keenanwgn
Credited to XlabAITeam, A7um, tl2cents, and keenanwgn
sm-crypto Affected by Signature Malleability in SM2-DSA High
CVE-2026-23967 was published for sm-crypto (npm) Jan 21, 2026
XlabAITeam A7um
tl2cents keenanwgn
Credited to XlabAITeam, A7um, tl2cents, and keenanwgn
sm-crypto Affected by Private Key Recovery in SM2-PKE Critical
CVE-2026-23966 was published for sm-crypto (npm) Jan 21, 2026
XlabAITeam A7um
tl2cents keenanwgn
Credited to XlabAITeam, A7um, tl2cents, and keenanwgn
RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE High
CVE-2026-22700 was published for sm2 (Rust) Jan 13, 2026
XlabAITeam tl2cents
keenanwgn A7um
Credited to XlabAITeam, tl2cents, keenanwgn, and A7um
SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt() High
CVE-2026-22699 was published for sm2 (Rust) Jan 9, 2026
XlabAITeam tl2cents
keenanwgn A7um
Credited to XlabAITeam, tl2cents, keenanwgn, and A7um
SM2-PKE has 32-bit Biased Nonce Vulnerability High
CVE-2026-22698 was published for sm2 (Rust) Jan 9, 2026
XlabAITeam keenanwgn
tl2cents A7um
Credited to XlabAITeam, keenanwgn, tl2cents, and A7um
Flowise is vulnerable to arbitrary file exposure through its ReadFileTool High
GHSA-j44m-5v8f-gc9c was published for flowise (npm) Oct 10, 2025
XlabAITeam A7um
keenanwgn
Credited to XlabAITeam, A7um, and keenanwgn
gnark is vulnerable to signature malleability in EdDSA and ECDSA due to missing scalar checks High
CVE-2025-57801 was published for github.com/consensys/gnark (Go) Aug 22, 2025
sunyxedu A7um
XlabAITeam zL1nX kexinoh
Credited to sunyxedu, A7um, XlabAITeam, zL1nX, and kexinoh
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database