Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
102
GitHub Actions
54
Go
4,428
Maven
5,000+
npm
5,000+
NuGet
1,088
pip
5,000+
Pub
13
RubyGems
1,129
Rust
1,506
Swift
62
Unreviewed advisories
All unreviewed
5,000+

1,491 advisories

Loading
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Drupal core allows... Moderate Unreviewed
CVE-2026-55806 was published Jul 11, 2026
Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL Critical
CVE-2026-54072 was published for github.com/authorizerdev/authorizer (Go) Jul 10, 2026
morimori-dev Credited to morimori-dev
OpenRun: Redirect URL validation bypass using  //host  paths leads to Open Redirect Moderate
CVE-2026-55252 was published for github.com/openrundev/openrun (Go) Jul 9, 2026
Fushuling Credited to Fushuling and RacerZ-fighting RacerZ-fighting RacerZ-fighting
An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to... Moderate Unreviewed
CVE-2026-31982 was published Jul 9, 2026
Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that... Moderate Unreviewed
CVE-2026-59806 was published Jul 8, 2026
Waku has an Open Redirect via `unstable_redirect` Helper Low
CVE-2026-49456 was published for waku (npm) Jul 8, 2026
j0hndo Credited to j0hndo
Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp High
GHSA-86j7-9j95-vpqj was published for better-auth (npm) Jul 7, 2026
hillalee Credited to hillalee
Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint Moderate
CVE-2026-54724 was published for kiwitcms (pip) Jul 6, 2026
martindios Credited to martindios
Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps High
CVE-2026-55431 was published for github.com/coder/coder/v2 (Go) Jul 6, 2026
CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation Moderate
CVE-2026-53935 was published for github.com/cilium/cilium (Go) Jul 6, 2026
A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to... Low Unreviewed
CVE-2026-14632 was published Jul 4, 2026
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized... Critical Unreviewed
CVE-2026-41106 was published Jul 3, 2026
OpenClaw MCP SSE redirects could forward Authorization headers Moderate
GHSA-9c3v-684m-579c was published for openclaw (npm) Jul 1, 2026
dingliweixlm-byte Credited to dingliweixlm-byte
Concourse login flow has an open redirect issue Low
CVE-2026-49826 was published for github.com/concourse/concourse (Go) Jul 1, 2026
Fushuling Credited to Fushuling and RacerZ-fighting RacerZ-fighting RacerZ-fighting
URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation... Moderate Unreviewed
CVE-2026-58520 was published Jul 1, 2026
Invoice Ninja through 5.13.26 contains an open redirect vulnerability in the client portal login... Moderate Unreviewed
CVE-2026-58450 was published Jul 1, 2026
An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to... Moderate Unreviewed
CVE-2026-10562 was published Jun 30, 2026
Probo has an open redirect bypass via path normalization Moderate
CVE-2026-49820 was published for go.probo.inc/probo (Go) Jun 30, 2026
Fushuling Credited to Fushuling
Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection Moderate
CVE-2026-53523 was published for github.com/nezhahq/nezha (Go) Jun 26, 2026
alcls01111 Credited to alcls01111
Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body Moderate
CVE-2026-47070 was published for hackney (Erlang) Jun 26, 2026
PJUllrich Credited to PJUllrich and maennchen maennchen maennchen
Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking... Moderate Unreviewed
CVE-2026-13163 was published Jun 24, 2026
Flask-Security has an Open Redirect issue Moderate
GHSA-w2j7-f3c6-g8cw was published for Flask-Security (pip) Jun 23, 2026
RacerZ-fighting Credited to RacerZ-fighting and Fushuling Fushuling Fushuling
Gogs has an Open Redirect via redirect_to Moderate
CVE-2026-52802 was published for gogs.io/gogs (Go) Jun 23, 2026
quirmz Credited to quirmz
Nuxt versions 4.0.0 before 4.4.7 and 3.x before 3.21.7 accept protocol-relative paths such as /... Moderate Unreviewed
CVE-2026-56697 was published Jun 23, 2026
A vulnerability was detected in lemonldap-ng up to 2.23.0. Impacted is an unknown function in the... Low Unreviewed
CVE-2026-12804 was published Jun 21, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database