GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
Filter advisories
Filter advisories
GitHub reviewed advisories
All reviewed
5,000+
Composer
4,514
Erlang
33
GitHub Actions
25
Go
2,215
Maven
5,000+
npm
3,873
NuGet
696
pip
3,648
Pub
12
RubyGems
913
Rust
923
Swift
38
Unreviewed advisories
All unreviewed
5,000+
5,458 advisories
Filter by severity
The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
High
CVE-2025-31487
was published
for
org.xwiki.contrib.jira:jira-macro-default
(Maven)
Apr 4, 2025
Vipshop Saturn Console Vulnerable to SQL Injection via ClusterKey Component
High
CVE-2025-29085
was published
for
com.vip.saturn:saturn-console
(Maven)
Apr 2, 2025
Jenkins Missing Permission Check
Moderate
CVE-2025-31720
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
Apr 2, 2025
Jenkins Missing Permission Check
Moderate
CVE-2025-31721
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
Apr 2, 2025
Jenkins monitor-remote-job Plugin Stores Passwords Unencrypted
Moderate
CVE-2025-31725
was published
for
org.ukiuni.monitor-remote-job-plugin:monitor-remote-job
(Maven)
Apr 2, 2025
Jenkins AsakusaSatellite Plugin Stores API Keys Unencrypted in Job `config.xml` Files
Moderate
CVE-2025-31727
was published
for
org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin
(Maven)
Apr 2, 2025
Jenkins Stack Hammer Plugin Stores API Keys Unencrypted in Job `config.xml` Files
Moderate
CVE-2025-31726
was published
for
org.jenkins-ci.plugins:stackhammer
(Maven)
Apr 2, 2025
Jenkins AsakusaSatellite Plugin Does not Mask API Keys via Job Configuration Form
Moderate
CVE-2025-31728
was published
for
org.codefirst.jenkins.asakusasatellite:asakusa-satellite-plugin
(Maven)
Apr 2, 2025
Jenkins Templating Engine Plugin Vulnerable to Arbitrary Code Execution
High
CVE-2025-31722
was published
for
org.jenkins-ci.plugins:templating-engine
(Maven)
Apr 2, 2025
Jenkins Simple Queue Plugin Cross-Site Request Forgery (CSRF)
Moderate
CVE-2025-31723
was published
for
io.jenkins.plugins:simple-queue
(Maven)
Apr 2, 2025
Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted
Moderate
CVE-2025-31724
was published
for
org.jenkins-ci.plugins:vmanager-plugin
(Maven)
Apr 2, 2025
jooby-pac4j: deserialization of untrusted data
High
CVE-2025-31129
was published
for
io.jooby:jooby-pac4j
(Maven)
Apr 1, 2025
Apache Camel Missing Header Out Filter Leads to Potential Bypass/Injection Vulnerability
Moderate
CVE-2025-30177
was published
for
org.apache.camel:camel-undertow
(Maven)
Apr 1, 2025
Apache Pinot Vulnerable to Authentication Bypass
Critical
CVE-2024-56325
was published
for
org.apache.pinot:pinot
(Maven)
Apr 1, 2025
Apache Parquet Avro Module Vulnerable to Arbitrary Code Execution
Critical
CVE-2025-30065
was published
for
org.apache.parquet:parquet-avro
(Maven)
Apr 1, 2025
Apache ActiveMQ Artemis User Without Create Address Permissions can Modify Address Routing-Type
Low
CVE-2025-27427
was published
for
org.apache.activemq:artemis-server
(Maven)
Apr 1, 2025
Netty QUIC hash collision DoS attack
Moderate
CVE-2025-29908
was published
for
io.netty.incubator:netty-incubator-codec-quic
(Maven)
Mar 31, 2025
Solon Vulnerable to Path Traversal
Moderate
CVE-2025-2961
was published
for
org.noear:solon-view
(Maven)
Mar 31, 2025
Infinispan Potential Out of Memory Error via REST Compare API Buffer API
Moderate
CVE-2024-6875
was published
for
org.infinispan:infinispan-query
(Maven)
Mar 28, 2025
Apache Kylin Code Injection via JDBC Configuration Alteration
Low
CVE-2025-30067
was published
for
org.apache.kylin:kylin
(Maven)
Mar 27, 2025
Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint
Low
CVE-2024-48944
was published
for
org.apache.kylin:kylin-common-server
(Maven)
Mar 27, 2025
WildFly Elytron OpenID Connect Client ExtensionOIDC authorization code injection attack
Moderate
CVE-2024-12369
was published
for
org.wildfly.security:wildfly-elytron
(Maven)
Mar 25, 2025
Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache
Moderate
CVE-2025-2559
was published
for
org.keycloak:keycloak-services
(Maven)
Mar 25, 2025
OpenDaylight SFC Insecure Shiro Cookie Configuration
High
CVE-2025-29314
was published
for
org.opendaylight.sfc:odl-sfc-openflow-renderer
(Maven)
Mar 24, 2025
OpenDaylight SFC Allows Unauthorized Privileged Execution via Crafted Request
Critical
CVE-2025-29315
was published
for
org.opendaylight.sfc:sfc-parent
(Maven)
Mar 24, 2025
ProTip!
Advisories are also available from the
GraphQL API