| CARVIEW |
Select Language
HTTP/2 200
date: Fri, 26 Dec 2025 22:12:03 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With,Accept-Encoding, Accept, X-Requested-With
etag: W/"9a145f4f2752d4bcffce8d5c8a8c19bb"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com marketplace-screenshots.githubusercontent.com/ copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=pOQWcGxs8PXyPFJmb7MJW4rlNVu4rZpudGkUh05Dxecfshx%2FMlppmGtkzOOQulLLeVxgfnocynTLNg2C27Ei%2FX%2BBiVo1UPdVL8YYqdA2nioiot6fRrfjNchb1OEcIF7rE%2FPyRLaQOavbxxEzu9vnz6jGDcDnmpKijbAlSak4wZbIyQdW4JzFxewEUmsfHA%2F2YRH0ZhPmIzw5jkTYcO3fnDElYPo%2F18ewiSafHWTFNLEUJ1MgH77%2FihyG2Np7X5LoFd6MrU3nfN7B1mCBSFwE7Q%3D%3D--bTXXTlSEmwiJf9gO--Yc4YFRoe88McNxqI7oekGA%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.1188765613.1766787122; Path=/; Domain=github.com; Expires=Sat, 26 Dec 2026 22:12:02 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Sat, 26 Dec 2026 22:12:02 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: A2A2:2C07D:3D5E6DE:497EADB:694F0832
GitHub Advisory Database · GitHub
Loading
Skip to content
Navigation Menu
GitHub Advisory Database
{{ message }}
GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
Filter advisories
Filter advisories
GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
40
GitHub Actions
38
Go
2,778
Maven
5,000+
npm
4,379
NuGet
770
pip
4,149
Pub
12
RubyGems
963
Rust
1,071
Swift
45
Unreviewed advisories
All unreviewed
5,000+
25,145 advisories
Filter by severity
ruint affected by unsoundness of safe `reciprocal_mg10`
Moderate
GHSA-9fjq-45qv-pcm7
was published
for
ruint
(Rust)
Dec 26, 2025
apidoc-core has a prototype pollution vulnerability
Critical
CVE-2025-13158
was published
for
apidoc-core
(npm)
Dec 26, 2025
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
High
CVE-2025-68697
was published
for
n8n
(npm)
Dec 26, 2025
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
Critical
CVE-2025-68668
was published
for
n8n
(npm)
Dec 26, 2025
lmdeploy vulnerable to Arbitrary Code Execution via Insecure Deserialization in torch.load()
High
CVE-2025-67729
was published
for
lmdeploy
(pip)
Dec 26, 2025
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
High
CVE-2025-61914
was published
for
n8n
(npm)
Dec 26, 2025
libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS)
High
CVE-2025-25341
was published
for
libxmljs
(npm)
Dec 26, 2025
Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order
Moderate
CVE-2025-68943
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries
Moderate
CVE-2025-68944
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Gitea: anonymous user can visit private user's project
Moderate
CVE-2025-68945
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Gitea vulnerable to Cross-site Scripting
Moderate
CVE-2025-68946
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text
Moderate
CVE-2025-68942
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Gitea allows attackers to add attachments with forbidden file extensions
High
CVE-2025-68939
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Gitea mishandles authorization for deletion of releases
Moderate
CVE-2025-68938
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources
Moderate
CVE-2025-68941
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.
Low
CVE-2025-68940
was published
for
code.gitea.io/gitea
(Go)
Dec 26, 2025
Mattermost doesn't validate user channel membership when attaching Mattermost posts as comments to Jira issues
Moderate
CVE-2025-13767
was published
for
github.com/mattermost/mattermost-server
(Go)
Dec 24, 2025
Mattermost doesn't verify that post actions invoking `/share-issue-publicly` were created by the Jira plugin
Moderate
CVE-2025-64641
was published
for
github.com/mattermost/mattermost-server
(Go)
Dec 24, 2025
LangChain serialization injection vulnerability enables secret extraction
High
CVE-2025-68665
was published
for
@langchain/core
(npm)
Dec 23, 2025
httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage
High
CVE-2025-68696
was published
for
httparty
(RubyGems)
Dec 23, 2025
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
Critical
CVE-2025-68664
was published
for
langchain-core
(pip)
Dec 23, 2025
Cadmium CMS has a background arbitrary file upload vulnerability
High
CVE-2025-51511
was published
for
cadmium-org/cadmium-cms
(Composer)
Dec 23, 2025
Home Assistant Core before is vulnerable to Directory Traversal
Moderate
CVE-2025-65713
was published
for
homeassistant
(pip)
Dec 23, 2025
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
Moderate
CVE-2025-68614
was published
for
librenms/librenms
(Composer)
Dec 23, 2025
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
Moderate
CVE-2025-67743
was published
for
local-deep-research
(pip)
Dec 23, 2025
ProTip!
Advisories are also available from the
GraphQL API
You can’t perform that action at this time.