The Wayback Machine - https://web.archive.org/web/20221220123845/https://github.com/advisories
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
1,203
Erlang
19
GitHub Actions
6
Go
705
Maven
2,899
npm
2,782
NuGet
252
pip
1,485
Pub
3
RubyGems
533
Rust
552
Unreviewed advisories
All unreviewed
5,000+

10,375 advisories

ghinstallation returns app JWT in error responses Moderate
CVE-2022-39304 was published for github.com/bradleyfalzon/ghinstallation (Go) Dec 19, 2022
Miskerest
Cortex's Alertmanager can expose local files content via specially crafted config Moderate
CVE-2022-23536 was published for github.com/cortexproject/cortex (Go) Dec 19, 2022
aus
Subsite weakens file permissions Moderate
CVE-2022-42949 was published for silverstripe/subsites (Composer) Dec 19, 2022
FurqanSoftware/node-whois vulnerable to Prototype Pollution Moderate
CVE-2020-36618 was published for whois (npm) Dec 19, 2022
Oils JS vulnerable to Open Redirect Moderate
CVE-2021-4260 was published for oils (npm) Dec 19, 2022
Apache Helix UI vulnerable to Open Redirect Moderate
CVE-2022-47500 was published for org.apache.helix:helix (Maven) Dec 19, 2022
Memos Cross-site Scripting vulnerability Moderate
CVE-2022-4609 was published for github.com/usememos/memos (Go) Dec 19, 2022
Terms and Conditions Module vulnerable to Open Redirect Moderate
CVE-2022-4589 was published for django-termsandconditions (pip) Dec 17, 2022
UBI Reader vulnerable to Path Traversal Moderate
CVE-2022-4572 was published for ubi-reader (pip) Dec 17, 2022
HuTool vulnerable to Uncontrolled Resource Consumption Moderate
CVE-2022-4565 was published for cn.hutool:hutool-core (Maven) Dec 16, 2022
Alist vulnerable to Path Traversal Moderate
CVE-2022-45969 was published for github.com/alist-org/alist/v3 (Go) Dec 16, 2022
Apache Bookkeeper vulnerable to Improper Certificate Validation High
CVE-2022-32531 was published for org.apache.bookkeeper:bookkeeper-common (Maven) Dec 15, 2022
FeehiCMS Cross Site Scripting vulnerability Moderate
CVE-2021-36572 was published for feehi/feehicms (Composer) Dec 15, 2022
FeehiCMS Unrestricted Upload vulnerability Moderate
CVE-2021-36573 was published for feehi/feehicms (Composer) Dec 15, 2022
FeehiCMS Cross Site Scripting vulnerability Moderate
CVE-2022-40002 was published for feehi/feehicms (Composer) Dec 15, 2022
FeehiCMS Cross Site Scripting vulnerability Moderate
CVE-2022-40373 was published for feehi/feehicms (Composer) Dec 15, 2022
FeehiCMS Cross Site Scripting vulnerability Moderate
CVE-2022-40001 was published for feehi/feehicms (Composer) Dec 15, 2022
FeehiCMS Cross Site Scripting vulnerability Moderate
CVE-2022-40000 was published for feehi/feehicms (Composer) Dec 15, 2022
npm package rfc6902 vulnerable to Prototype Pollution Moderate
CVE-2021-4245 was published for rfc6902 (npm) Dec 15, 2022
easywebpack-cli Path Traversal vulnerability Moderate
CVE-2020-24855 was published for @easy-team/easywebpack-cli (npm) Dec 15, 2022
replicator vulnerable to Deserialization of Untrusted Data Critical
CVE-2021-33420 was published for replicator (npm) Dec 15, 2022
FeehiCMS vulnerable to Cross Site Scripting Moderate
CVE-2020-20589 was published for feehi/feehicms (Composer) Dec 15, 2022
FeehiCMS Cross Site Scripting vulnerability Moderate
CVE-2020-36607 was published for feehi/feehicms (Composer) Dec 15, 2022
WSO2 carbon-registry vulnerable to Cross-site Scripting Moderate
CVE-2022-4521 was published for org.wso2.carbon.registry:carbon-registry (Maven) Dec 15, 2022
django-photologue vulnerable to Cross-site Scripting Moderate
CVE-2022-4526 was published for django-photologue (pip) Dec 15, 2022
ProTip! Advisories are also available from the GraphQL API