Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
39
GitHub Actions
38
Go
2,698
Maven
5,000+
npm
4,325
NuGet
761
pip
4,099
Pub
12
RubyGems
958
Rust
1,063
Swift
45
Unreviewed advisories
All unreviewed
5,000+

2,030 advisories

Loading
React Server Components are Vulnerable to RCE Critical
GHSA-fmh4-wr37-44fp was published for @vitejs/plugin-rsc (npm) Dec 3, 2025
React Server Components are Vulnerable to RCE Critical
CVE-2025-55182 was published for react-server-dom-parcel (npm) Dec 3, 2025
lachlan2k
Credited to lachlan2k
Next.js is vulnerable to RCE in React flight protocol Critical
CVE-2025-66478 was published for next (npm) Dec 3, 2025
lachlan2k
Credited to lachlan2k
An unauthenticated attacker can trick a local user into executing arbitrary code by opening a... High Unreviewed
CVE-2025-41700 was published Dec 1, 2025
Fugue is Vulnerable to Remote Code Execution by Pickle Deserialization via FlaskRPCServer High
CVE-2025-62703 was published for fugue (pip) Nov 25, 2025
Chenpinji
Credited to Chenpinji
Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization Moderate
CVE-2025-13467 was published for org.keycloak:keycloak-ldap-federation (Maven) Nov 25, 2025
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to... Critical Unreviewed
CVE-2025-51745 was published Nov 25, 2025
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /materialCategory/addMaterialCategory... Critical Unreviewed
CVE-2025-51743 was published Nov 25, 2025
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /serialNumber/addSerialNumber endpoint... Critical Unreviewed
CVE-2025-51746 was published Nov 25, 2025
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material... Critical Unreviewed
CVE-2025-51742 was published Nov 25, 2025
The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and... Moderate Unreviewed
CVE-2025-9191 was published Nov 26, 2025
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to... Critical Unreviewed
CVE-2025-51744 was published Nov 25, 2025
An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute... Critical Unreviewed
CVE-2025-61168 was published Nov 25, 2025
Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows... Moderate Unreviewed
CVE-2025-66073 was published Nov 21, 2025
vLLM deserialization vulnerability leading to DoS and potential RCE High
CVE-2025-62164 was published for vllm (pip) Nov 20, 2025
omriaxion russellb
DarkLight1337 Isotr0py ywang96
Credited to omriaxion, russellb, DarkLight1337, Isotr0py, and ywang96
Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email... High Unreviewed
CVE-2025-66055 was published Nov 21, 2025
IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11... High Unreviewed
CVE-2025-36072 was published Nov 21, 2025
Microsoft SharePoint Online Elevation of Privilege Vulnerability Critical Unreviewed
CVE-2025-59245 was published Nov 21, 2025
Apache Causeway vulnerable to deserialization in Java Critical
CVE-2025-64408 was published for org.apache.causeway.commons:causeway-commons (Maven) Nov 19, 2025
The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to PHP... High Unreviewed
CVE-2025-13145 was published Nov 19, 2025
Arbitrary Code Execution in pdfminer.six via Crafted PDF Input High
CVE-2025-64512 was published for pdfminer.six (pip) Nov 7, 2025
mtolley
Credited to mtolley
Modular Max Serve has Unsafe Deserialization vulnerability Critical
CVE-2025-60455 was published for modular (pip) Nov 18, 2025
Drupal core allows Object Injection Moderate
CVE-2025-13081 was published for drupal/core (Composer) Nov 18, 2025
Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user... Critical Unreviewed
CVE-2025-60245 was published Nov 6, 2025
Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows... Critical Unreviewed
CVE-2025-58998 was published Nov 6, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database