GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
9 advisories
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Moderate
CVE-2026-54256
was published
for
winter/wn-backend-module
(Composer)
Aug 20, 2026
Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses
Moderate
CVE-2026-54562
was published
for
github.com/cloudreve/Cloudreve/v3
(Go)
Jul 20, 2026
Sylius: IDOR on Shop Payment Request API endpoints
Moderate
CVE-2026-53639
was published
for
sylius/sylius
(Composer)
Jul 9, 2026
Sharp Missing Authorization Check in Quick Creation Command Endpoints
Moderate
CVE-2026-53634
was published
for
code16/sharp
(Composer)
Jul 8, 2026
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
Moderate
CVE-2026-53521
was published
for
github.com/nezhahq/nezha
(Go)
Jun 26, 2026
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
Moderate
CVE-2026-48067
was published
for
filament/actions
(Composer)
Jun 11, 2026
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Moderate
CVE-2026-47745
was published
for
shopper/framework
(Composer)
Jun 5, 2026
Shopper: Missing authorization on Product admin Livewire sub-form components
Moderate
CVE-2026-47742
was published
for
shopper/framework
(Composer)
Jun 5, 2026
shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption
Moderate
CVE-2026-47741
was published
for
shopper/cart
(Composer)
May 18, 2026
ProTip!
Advisories are also available from the
GraphQL API