GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
High
CVE-2026-55882
was published
for
github.com/tilt-dev/tilt
(Go)
Jun 19, 2026
Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream
High
CVE-2026-55883
was published
for
github.com/tilt-dev/tilt
(Go)
Jun 19, 2026
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
High
CVE-2026-49340
was published
for
go.senan.xyz/gonic
(Go)
Jun 26, 2026
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
High
CVE-2026-49338
was published
for
go.senan.xyz/gonic
(Go)
Jun 26, 2026
Laravel Backpack CRUD: Unverified password change in MyAccountController via mass assignment
High
CVE-2026-54175
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
High
CVE-2026-54178
was published
for
backpack/crud
(Composer)
Aug 20, 2026
Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
High
CVE-2026-54182
was published
for
backpack/crud
(Composer)
Aug 20, 2026
ProTip!
Advisories are also available from the
GraphQL API