GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
9 advisories
Snipe-IT has a 2FA reset privilege bypass
Moderate
CVE-2026-50550
was published
for
snipe/snipe-it
(Composer)
Jun 23, 2026
Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing users
High
CVE-2026-48507
was published
for
snipe/snipe-it
(Composer)
Jun 23, 2026
Nautobot: Webhook definitions could be used for server-side request forgery (SSRF)
High
CVE-2026-44797
was published
for
nautobot
(pip)
May 13, 2026
Nautobot: Object bulk rename UI actions vulnerable to denial of service by crafted regular expression (REDoS)
Moderate
CVE-2026-44796
was published
for
nautobot
(pip)
May 13, 2026
Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference
Moderate
CVE-2026-44794
was published
for
nautobot
(pip)
May 13, 2026
wger: trainer_login open redirect - ?next= parameter not validated against host
Moderate
GHSA-vqv8-j3mj-wjxj
was published
for
wger
(pip)
May 6, 2026
wger: cross-tenant password reset and plaintext disclosure via gym=None bypass
Critical
CVE-2026-43948
was published
for
wger
(pip)
May 6, 2026
wger: CSV/TSV formula injection in gym member export (first_name/last_name)
High
GHSA-xq9m-hmp9-fw87
was published
for
wger
(pip)
May 6, 2026
Weblate Doesn't Invalidate API Token on Password Change
Moderate
CVE-2026-41519
was published
for
weblate
(pip)
Apr 30, 2026
ProTip!
Advisories are also available from the
GraphQL API