GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
6 advisories
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
High
CVE-2026-59185
was published
for
github.com/identrail/identrail
(Go)
Sep 9, 2026
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Moderate
CVE-2026-71494
was published
for
github.com/infracost/infracost
(Go)
Sep 8, 2026
Infracost: Arbitrary file read via config-template readFile symlink traversal
Moderate
CVE-2026-71493
was published
for
github.com/infracost/infracost
(Go)
Sep 8, 2026
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
Moderate
CVE-2026-73556
was published
for
vllm
(pip)
Sep 4, 2026
jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
Moderate
CVE-2026-59889
was published
for
com.fasterxml.jackson.core:jackson-databind
(Maven)
Jul 21, 2026
Grav: Stored CSS injection via Markdown image ?style=… reaches MediaObjectTrait::style() — incomplete patch of GHSA-r7fx-8g49-7hhr
Moderate
CVE-2026-55890
was published
for
getgrav/grav
(Composer)
Jun 18, 2026
ProTip!
Advisories are also available from the
GraphQL API