Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,521
Maven
5,000+
npm
5,000+
NuGet
911
pip
4,760
Pub
13
RubyGems
1,036
Rust
1,229
Swift
53
Unreviewed advisories
All unreviewed
5,000+

4,026 advisories

Loading
Improper privilege management in Microsoft Windows allows an authorized attacker to deny service... Moderate Unreviewed
CVE-2026-32181 was published Apr 14, 2026
A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul... High Unreviewed
CVE-2026-38529 was published Apr 14, 2026
The BuddyPress Groupblog plugin for WordPress is vulnerable to Privilege Escalation in all... High Unreviewed
CVE-2026-5144 was published Apr 11, 2026
Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource Moderate
CVE-2026-39961 was published for github.com/aiven/aiven-operator (Go) Apr 10, 2026
AndresAIFR Credited to AndresAIFR
Vikunja vulnerable to Privilege Escalation via Project Reparenting High
CVE-2026-35595 was published for code.vikunja.io/api (Go) Apr 10, 2026
adrgs Credited to adrgs and aisafe-bot aisafe-bot aisafe-bot
The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate... High Unreviewed
CVE-2026-29923 was published Apr 9, 2026
OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write` Low
GHSA-4f8g-77mw-3rxc was published for openclaw (npm) Apr 9, 2026
smaeljaish771 Credited to smaeljaish771 and KeenSecurityLab KeenSecurityLab KeenSecurityLab
OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval Moderate
GHSA-67mf-f936-ppxf was published for openclaw (npm) Apr 9, 2026
nicky-cc Credited to nicky-cc
File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands High
CVE-2026-35607 was published for github.com/filebrowser/filebrowser/v2 (Go) Apr 8, 2026
kodareef5 Credited to kodareef5
OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill Moderate
GHSA-5hff-46vh-rxmw was published for openclaw (npm) Apr 7, 2026
EaEa0001 Credited to EaEa0001
OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send Low
GHSA-767m-xrhc-fxm7 was published for openclaw (npm) Apr 7, 2026
zpbrent Credited to zpbrent
OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send Moderate
GHSA-3q42-xmxv-9vfr was published for openclaw (npm) Apr 7, 2026
zpbrent Credited to zpbrent
An issue that allowed all-organization administrators to promote accounts to superuser status has... High Unreviewed
CVE-2026-5373 was published Apr 7, 2026
CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS Critical
CVE-2026-34989 was published for ci4-cms-erp/ci4ms (Composer) Apr 3, 2026
bugmithlegend Credited to bugmithlegend and peeefour peeefour peeefour
OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing High
GHSA-gg9v-mgcp-v6m7 was published for openclaw (npm) Apr 3, 2026
tdjackey Credited to tdjackey
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls Moderate
GHSA-9gp8-hjxr-6f34 was published for openclaw (npm) Apr 3, 2026
AntAISecurityLab Credited to AntAISecurityLab
HiSecOS web server contains a privilege escalation vulnerability that allows authenticated users... High Unreviewed
CVE-2023-7343 was published Apr 2, 2026
HiSecOS web server contains a privilege escalation vulnerability that allows authenticated users... High Unreviewed
CVE-2023-7342 was published Apr 2, 2026
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS... High Unreviewed
CVE-2024-44250 was published Apr 2, 2026
OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes Moderate
GHSA-mhgq-xpfq-6r66 was published for openclaw (npm) Apr 2, 2026
davidluzsilva Credited to davidluzsilva
File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution High
CVE-2026-34528 was published for github.com/filebrowser/filebrowser/v2 (Go) Mar 31, 2026
offset Credited to offset
OpenClaw: Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send High
CVE-2026-35621 was published for openclaw (npm) Mar 30, 2026
zpbrent Credited to zpbrent
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin Critical
CVE-2026-35663 was published for openclaw (npm) Mar 27, 2026
zpbrent Credited to zpbrent
Ella Core has Privilege Escalation via Database Restore by NetworkManager role High
CVE-2026-33906 was published for github.com/ellanetworks/core (Go) Mar 26, 2026
offset Credited to offset
OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve Critical
CVE-2026-35639 was published for openclaw (npm) Mar 26, 2026
zpbrent Credited to zpbrent
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database