Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,549
Maven
5,000+
npm
5,000+
NuGet
917
pip
4,798
Pub
13
RubyGems
1,038
Rust
1,237
Swift
53
Unreviewed advisories
All unreviewed
5,000+

29,215 advisories

Loading
Kimai: Username enumeration via timing on X-AUTH-USER Low
GHSA-jrc6-fmhw-fpq2 was published for kimai/kimai (Composer) Apr 17, 2026
melnicek Credited to melnicek
PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315) High
GHSA-rg3h-x3jw-7jm5 was published for praisonai (pip) Apr 17, 2026
BerSecHub Credited to BerSecHub
Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI Critical
GHSA-9qhq-v63v-fv3j was published for praisonai (pip) Apr 17, 2026
OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR High
GHSA-8gmg-3w2q-65f4 was published for go.opentelemetry.io/obi (Go) Apr 17, 2026
MrAlias Credited to MrAlias and arminru arminru arminru
yard: Possible arbitrary path traversal and file access via yard server Moderate
GHSA-3jfp-46x4-xgfj was published for yard (RubyGems) Apr 17, 2026
Dapr: Service Invocation path traversal ACL bypass High
GHSA-85gx-3qv6-4463 was published for github.com/dapr/dapr (Go) Apr 17, 2026
cicoyle Credited to cicoyle and acroca acroca acroca
Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows Moderate
CVE-2026-35603 was published for @anthropic-ai/claude-code (npm) Apr 17, 2026
OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets Moderate
GHSA-f7fh-qg34-x2xh was published for openclaw (npm) Apr 17, 2026
nicky-cc Credited to nicky-cc
OpenClaw: Sender policy bypass in host media attachment reads allows unauthorized local file disclosure Moderate
GHSA-jhpv-5j76-m56h was published for openclaw (npm) Apr 17, 2026
Telecaster2147 Credited to Telecaster2147
OpenClaw: QQBot media tags could read arbitrary local files through reply text High
GHSA-66r7-m7xm-v49h was published for openclaw (npm) Apr 17, 2026
feiyang666 Credited to feiyang666
OpenClaw: busybox and toybox applet execution weakened exec approval binding High
GHSA-2cq5-mf3v-mx44 was published for openclaw (npm) Apr 17, 2026
OpenClaw: Matrix profile config persistence was reachable from operator.write message tools High
GHSA-7jp6-r74r-995q was published for openclaw (npm) Apr 17, 2026
zpbrent Credited to zpbrent
OpenClaw: Sandboxed agents could escape exec routing via host=node override High
GHSA-736r-jwj6-4w23 was published for openclaw (npm) Apr 17, 2026
zsxsoft Credited to zsxsoft, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenClaw: Browser press/type interaction routes missed complete navigation guard coverage Moderate
GHSA-536q-mj95-h29h was published for openclaw (npm) Apr 17, 2026
zsxsoft Credited to zsxsoft, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads Moderate
GHSA-qmwg-qprg-3j38 was published for openclaw (npm) Apr 17, 2026
tdjackey Credited to tdjackey
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins High
GHSA-939r-rj45-g2rj was published for openclaw (npm) Apr 17, 2026
zpbrent Credited to zpbrent
OpenClaw: Existing-session browser interaction routes bypassed SSRF policy enforcement Moderate
GHSA-527m-976r-jf79 was published for openclaw (npm) Apr 17, 2026
zsxsoft Credited to zsxsoft, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenClaw: Browser tabs action select and close routes bypassed SSRF policy Moderate
GHSA-rj2p-j66c-mgqh was published for openclaw (npm) Apr 17, 2026
nicky-cc Credited to nicky-cc
OpenClaw: Nostr profile mutation routes allowed operator.write config persistence Moderate
GHSA-f3h5-h452-vp3j was published for openclaw (npm) Apr 17, 2026
zpbrent Credited to zpbrent
OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0 High
GHSA-525j-hqq2-66r4 was published for openclaw (npm) Apr 17, 2026
R1kko1337 Credited to R1kko1337
OpenClaw: Channel setup catalog lookups could include untrusted workspace plugin shadows High
GHSA-82qx-6vj7-p8m2 was published for openclaw (npm) Apr 17, 2026
zsxsoft Credited to zsxsoft, KeenSecurityLab, and qclawer KeenSecurityLab KeenSecurityLab
qclawer qclawer
OpenClaw: screen_record outPath bypassed workspace-only filesystem guard Moderate
GHSA-jf25-7968-h2h5 was published for openclaw (npm) Apr 17, 2026
OpenClaw: Browser SSRF policy default allowed private-network navigation Moderate
GHSA-53vx-pmqw-863c was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
OpenClaw: Browser SSRF hostname validation could be bypassed by DNS rebinding Moderate
GHSA-xq94-r468-qwgj was published for openclaw (npm) Apr 17, 2026
dhyabi2 Credited to dhyabi2
OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes Moderate
GHSA-2767-2q9v-9326 was published for openclaw (npm) Apr 17, 2026
threalwinky Credited to threalwinky
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database