Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
49
GitHub Actions
49
Go
3,405
Maven
5,000+
npm
5,000+
NuGet
882
pip
4,641
Pub
13
RubyGems
1,026
Rust
1,209
Swift
53
Unreviewed advisories
All unreviewed
5,000+

16,703 advisories

Loading
OpenSTAManager has a SQL Injection via righe Parameter in confronta_righe Modals High
CVE-2026-35470 was published for devcode-it/openstamanager (Composer) Apr 3, 2026
ormzro Credited to ormzro
** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to sanitize category IDs before... High Unreviewed
CVE-2026-25773 was published Apr 3, 2026
OpenSTAManager: SQL Injection via Aggiornamenti Module High
CVE-2026-35168 was published for devcode-it/openstamanager (Composer) Apr 3, 2026
ormzro Credited to ormzro
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in... High Unreviewed
CVE-2026-33614 was published Apr 2, 2026
An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in... Critical Unreviewed
CVE-2026-33615 was published Apr 2, 2026
An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection... High Unreviewed
CVE-2026-33616 was published Apr 2, 2026
NocoBase Has SQL Injection via template variable substitution in workflow SQL node High
CVE-2026-34825 was published for @nocobase/plugin-workflow-sql (npm) Apr 1, 2026
PraisonAI Has Second-Order SQL Injection in `get_all_user_threads` Critical
CVE-2026-34934 was published for praisonai (pip) Apr 1, 2026
YeranG30 Credited to YeranG30
Payload has an SQL Injection via Query Handling High
CVE-2026-34747 was published for payload (npm) Apr 1, 2026
hessandrew Credited to hessandrew and arkmarta arkmarta arkmarta
OpenSTAManager has a Time-Based Blind SQL Injection via `options[stato]` Parameter High
CVE-2026-28805 was published for devcode-it/openstamanager (Composer) Apr 1, 2026
ormzro Credited to ormzro
pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent... High Unreviewed
CVE-2026-30273 was published Apr 1, 2026
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice... Moderate Unreviewed
CVE-2026-21630 was published Apr 1, 2026
IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection.... High Unreviewed
CVE-2025-13855 was published Apr 1, 2026
The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to... Moderate Unreviewed
CVE-2026-4668 was published Apr 1, 2026
SciTokens is vulnerable to SQL Injection in KeyCache Critical
CVE-2026-32714 was published for scitokens (pip) Mar 31, 2026
pmcao Credited to pmcao and djw8605 djw8605 djw8605
baserCMS has an SQL injection vulnerability in its blog post functionality Moderate
CVE-2026-27697 was published for baserproject/basercms (Composer) Mar 31, 2026
A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The... Moderate Unreviewed
CVE-2026-30520 was published Mar 31, 2026
SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly... Critical Unreviewed
CVE-2026-4317 was published Mar 31, 2026
Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin Moderate
CVE-2026-34386 was published for github.com/fleetdm/fleet/v4 (Go) Mar 30, 2026
prateek-0490 Credited to prateek-0490
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database Moderate
CVE-2026-34385 was published for github.com/fleetdm/fleet/v4 (Go) Mar 30, 2026
prateek-0490 Credited to prateek-0490
SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the... High Unreviewed
CVE-2026-33643 was published Mar 30, 2026
SQL Injection vulnerability in SchemaHero 0.23.0 via the column parameter to the columnAsInsert... High Unreviewed
CVE-2026-29953 was published Mar 30, 2026
MikroORM is vulnerable to SQL Injection via specially crafted object Critical
CVE-2026-34220 was published for @mikro-orm/core (npm) Mar 29, 2026
lukas-eu Credited to lukas-eu
A vulnerability has been found in code-projects Accounting System 1.0. This affects an unknown... Moderate Unreviewed
CVE-2026-5035 was published Mar 29, 2026
A vulnerability was detected in code-projects Accounting System 1.0. Affected by this... Moderate Unreviewed
CVE-2026-5033 was published Mar 29, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database