Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,654 advisories

Loading
Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized... Moderate Unreviewed
CVE-2026-81964 was published Oct 13, 2026
Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM... Critical Unreviewed
CVE-2026-109758 was published Oct 13, 2026
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows... Critical Unreviewed
CVE-2026-109566 was published Oct 12, 2026
GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application... Moderate Unreviewed
CVE-2026-107437 was published Oct 12, 2026
pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in... High Unreviewed
CVE-2026-108905 was published Oct 11, 2026
Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host... Critical Unreviewed
CVE-2026-108753 was published Oct 11, 2026
Default factory credentials with administrative access are enabled and persist even after... Critical Unreviewed
CVE-2026-32645 was published Oct 9, 2026
The published Docker image for openPDC includes a fixed administrative credential with no forced... Critical Unreviewed
CVE-2026-105278 was published Oct 9, 2026
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain... Moderate Unreviewed
CVE-2026-84891 was published Oct 9, 2026
IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard... High Unreviewed
CVE-2026-84250 was published Oct 8, 2026
Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script... High Unreviewed
CVE-2026-85488 was published Oct 8, 2026
A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to obtain a static... High Unreviewed
CVE-2026-85422 was published Oct 8, 2026
The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow... Moderate Unreviewed
CVE-2026-92861 was published Oct 8, 2026
Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login Critical
CVE-2026-62252 was published for github.com/sipcapture/homer-app (Go) Oct 7, 2026
de3erve-hunter Credited to de3erve-hunter
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded... Critical Unreviewed
CVE-2026-54472 was published Oct 6, 2026
Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded... Critical Unreviewed
CVE-2026-61421 was published Oct 6, 2026
Armatura One's database initialization routine assigns a fixed, vendor-defined password to the... High Unreviewed
CVE-2026-94592 was published Oct 3, 2026
Trigger.dev: V1 coordinator default-secret unauth Socket.IO Critical
GHSA-gg6r-gp4c-89hp was published for trigger.dev (npm) Oct 2, 2026
lissy93 Credited to lissy93
- Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword... Moderate Unreviewed
CVE-2026-27873 was published Oct 2, 2026
: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows :... Moderate Unreviewed
CVE-2026-27874 was published Oct 1, 2026
Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 ... Critical Unreviewed
CVE-2026-55395 was published Oct 1, 2026
The Joyland AI app contains hard-coded credentials for the GeTui push notification service,... Moderate Unreviewed
CVE-2026-102666 was published Oct 1, 2026
The Viidure Android application embeds permanent, plaintext cloud storage credentials within its... Critical Unreviewed
CVE-2026-96587 was published Sep 29, 2026
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API... High Unreviewed
CVE-2026-100294 was published Sep 29, 2026
A vulnerability relating to the use of predefined credentials in the Dbit T-CPE301K 4G WiFi mini... High Unreviewed
CVE-2026-7193 was published Sep 29, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database