Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,608
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

12 advisories

Loading
TYPO3 Remote Code Execution in extension "Content Element Selector" (ceselector) Critical
CVE-2026-46725 was published for mmc/ceselector (Composer) May 19, 2026
eliashaeussler Credited to eliashaeussler
TYPO3 Remote Code Execution in extension "Site Crawler" (crawler) High
CVE-2026-8727 was published for tomasnorre/crawler (Composer) May 19, 2026
eliashaeussler Credited to eliashaeussler
TYPO3 ke_search path traversal from arbitrary table configuration input Moderate
CVE-2026-46723 was published for tpwd/ke_search (Composer) May 19, 2026
eliashaeussler Credited to eliashaeussler
TYPO3 sf_register extension allows unauthorized assignment of frontend user groups Moderate
CVE-2026-46721 was published for evoweb/sf-register (Composer) May 19, 2026
eliashaeussler Credited to eliashaeussler
TYPO3 ke_search XML External Entity Injection Moderate
CVE-2026-46722 was published for tpwd/ke_search (Composer) May 19, 2026
eliashaeussler Credited to eliashaeussler
TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer Moderate
CVE-2026-46724 was published for tpwd/ke_search (Composer) May 19, 2026
eliashaeussler Credited to eliashaeussler
TYPO3 SQL Injection in extension "Address List" (tt_address) High
CVE-2026-8827 was published for friendsoftypo3/tt-address (Composer) May 19, 2026
eliashaeussler Credited to eliashaeussler
georgringer/news has SQL Injection in extension "News system" (news) High
CVE-2026-8726 was published for georgringer/news (Composer) May 19, 2026
eliashaeussler Credited to eliashaeussler and RobertLang RobertLang RobertLang
The mailqueue TYPO3 extension has Insecure Deserialization in `TransportFailure` class Moderate
CVE-2026-1323 was published for cpsit/typo3-mailqueue (Composer) Mar 18, 2026
eliashaeussler Credited to eliashaeussler
mailqueue TYPO3 extension affected by Insecure Deserialization in QueueableFileTransport Moderate
CVE-2026-0895 was published for cpsit/typo3-mailqueue (Composer) Jan 21, 2026
eliashaeussler Credited to eliashaeussler
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool Moderate
CVE-2026-0859 was published for typo3/cms-core (Composer) Jan 13, 2026
eliashaeussler Credited to eliashaeussler and ohader ohader ohader
TYPO3 Allows Information Disclosure via DBAL Restriction Handling Low
CVE-2025-47937 was published for typo3/cms-core (Composer) May 20, 2025
christianfutterlieb Credited to christianfutterlieb and eliashaeussler eliashaeussler eliashaeussler
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database