GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
8 advisories
go-git: Crafted repositories may modify main and submodule .git directories
Moderate
CVE-2026-45571
was published
for
github.com/go-git/go-git
(Go)
May 19, 2026
go-git: Improper single-quote escaping in go-git SSH transport
Low
CVE-2026-45570
was published
for
github.com/go-git/go-git
(Go)
May 19, 2026
gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository
High
GHSA-fr8x-3vfx-f45h
was published
for
gitoxide
(Rust)
May 5, 2026
gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository
High
GHSA-pg4w-g64p-qwhj
was published
for
gitoxide
(Rust)
May 5, 2026
go-git: Credential leak via cross-host redirect in smart HTTP transport
Moderate
CVE-2026-41506
was published
for
github.com/go-git/go-git/v5
(Go)
Apr 17, 2026
go-git improperly verifies data integrity values for .idx and .pack files
Moderate
CVE-2026-25934
was published
for
github.com/go-git/go-git/v5
(Go)
Feb 10, 2026
pypdf has possible long runtimes for missing /Root object with large /Size values
Low
CVE-2026-22690
was published
for
pypdf
(pip)
Jan 9, 2026
FPDI allows Memory Exhaustion (OOM) in PDF Parser which leads to Denial of Service
Moderate
CVE-2025-54869
was published
for
setasign/fpdi
(Composer)
Aug 5, 2025
ProTip!
Advisories are also available from the
GraphQL API