GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Moderate
GHSA-hjx8-qv73-f7cm
was published
for
code.vikunja.io/api
(Go)
Oct 9, 2026
fast-jwt: Verifier cache accepts expired JWTs without iat.
Moderate
CVE-2026-107719
was published
for
fast-jwt
(npm)
Oct 8, 2026
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers
Moderate
CVE-2026-107289
was published
for
pydantic-ai
(pip)
Oct 8, 2026
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
Critical
CVE-2026-102422
was published
for
shell-quote
(npm)
Oct 6, 2026
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Moderate
CVE-2026-102991
was published
for
Mako
(pip)
Oct 5, 2026
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
Moderate
CVE-2026-88932
was published
for
multer
(npm)
Sep 28, 2026
ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
Moderate
CVE-2026-101913
was published
for
ip-address
(npm)
Sep 28, 2026
ProTip!
Advisories are also available from the
GraphQL API