Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
4,951
Erlang
39
GitHub Actions
38
Go
2,607
Maven
5,000+
npm
4,251
NuGet
757
pip
4,017
Pub
12
RubyGems
953
Rust
1,049
Swift
45
Unreviewed advisories
All unreviewed
5,000+

3,097 advisories

Loading
PrivateBin is missing HTML sanitization of attached filename in file size hint Moderate
CVE-2025-62796 was published for privatebin/privatebin (Composer) Oct 28, 2025
MCMS reflected cross-site scripting (XSS) vulnerability Moderate
CVE-2025-60837 was published for net.mingsoft:ms-mcms (Maven) Oct 23, 2025
Piranha CMS vulnerable to stored cross-site scripting (XSS) Moderate
CVE-2025-61413 was published for Piranha (NuGet) Oct 23, 2025
Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS) Moderate
CVE-2025-62248 was published for com.liferay:com.liferay.dynamic.data.mapping.web (Maven) Oct 22, 2025
code16 Sharp vulnerable to Cross Site Scripting (XSS) Moderate
CVE-2025-61457 was published for code16/sharp (Composer) Oct 21, 2025
Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget Moderate
CVE-2025-62249 was published for com.liferay.portal:com.liferay.portal.impl (Maven) Oct 21, 2025
Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description Moderate
CVE-2025-62528 was published for taguette (pip) Oct 20, 2025
emilvirkki
Credited to emilvirkki
Citizen vulnerable to stored XSS in sticky header button messages Moderate
CVE-2025-62508 was published for starcitizentools/citizen-skin (Composer) Oct 20, 2025
SomeMWDev
Credited to SomeMWDev
Cargo Mediawiki Extension vulnerable to Cross-site Scripting Moderate
CVE-2025-62671 was published for mediawiki/cargo (Composer) Oct 18, 2025
ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text Moderate
GHSA-8c2g-f8jm-5cr7 was published for ibexa/fieldtype-richtext (Composer) Oct 17, 2025
ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal Moderate
GHSA-2mx6-fq24-g2mh was published for ibexa/admin-ui (Composer) Oct 17, 2025
ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal Moderate
GHSA-99c7-c3mw-mxhv was published for ezsystems/ezplatform-admin-ui (Composer) Oct 17, 2025
Keycloak error_description injection on error pages that can trigger phishing attacks Moderate
CVE-2025-10044 was published for org.keycloak:keycloak-account-ui (Maven) Oct 17, 2025
bagisto has Cross Site Scripting (XSS) in Create New Customer Moderate
CVE-2025-62414 was published for bagisto/bagisto (Composer) Oct 16, 2025
kiwi865
Credited to kiwi865
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG) Moderate
CVE-2025-62418 was published for bagisto/bagisto (Composer) Oct 16, 2025
kiwi865
Credited to kiwi865
bagisto has Cross Site Scripting (XSS) issue in TinyMCE Image Upload (HTML) Moderate
CVE-2025-62415 was published for bagisto/bagisto (Composer) Oct 16, 2025
kiwi865
Credited to kiwi865
LibreNMS has a Stored XSS vulnerability in its Alert Transport name field Moderate
CVE-2025-62411 was published for librenms/librenms (Composer) Oct 16, 2025
at4111
Credited to at4111
Magento vulnerable to stored Cross-Site Scripting (XSS) Moderate
CVE-2025-54266 was published for magento/community-edition (Composer) Oct 14, 2025
Apache Geode web-api is vulnerable to Cross-site Scripting Moderate
CVE-2024-44088 was published for org.apache.geode:geode-web-api (Maven) Oct 14, 2025
LibreNMS is vulnerable to Reflected-XSS in `report_this` function Moderate
CVE-2025-62365 was published for librenms/librenms (Composer) Oct 13, 2025
GatekeeperBuster
Credited to GatekeeperBuster
Liferay Mentions Web is Vulnerable to Cross-site Scripting Moderate
CVE-2025-62246 was published for com.liferay:com.liferay.mentions.web (Maven) Oct 13, 2025
QGIS QWC2 Cross-Site Scripting vulnerability Moderate
CVE-2025-11183 was published for qwc2 (npm) Oct 13, 2025
Liferay Portal Commerce is vulnerable to XSS through account "name" field Moderate
CVE-2025-62237 was published for com.liferay.commerce:com.liferay.commerce.order.web (Maven) Oct 10, 2025
Liferay Portal's Membership page is vulnerable to XSS through “name“ text field Moderate
CVE-2025-62238 was published for com.liferay:com.liferay.account.admin.web (Maven) Oct 10, 2025
Liferay Portal is vulnerable to XSS through its workflow process builder Moderate
CVE-2025-62239 was published for com.liferay:com.liferay.portal.workflow.kaleo.designer.web (Maven) Oct 10, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database