Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
4,877
Erlang
37
GitHub Actions
38
Go
2,538
Maven
5,000+
npm
4,197
NuGet
743
pip
3,971
Pub
12
RubyGems
947
Rust
1,030
Swift
39
Unreviewed advisories
All unreviewed
5,000+

43 advisories

Loading
DragonFly has weak integrity checks for downloaded files Moderate
CVE-2025-59354 was published for d7y.io/dragonfly/v2 (Go) Sep 17, 2025
gaius-qi
Mattermost makes Use of Weak Hash Moderate
CVE-2025-9078 was published for github.com/mattermost/mattermost-server (Go) Sep 15, 2025
CWE-328: Use of Weak Hash Moderate Unreviewed
CVE-2025-55053 was published Sep 9, 2025
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak... Moderate Unreviewed
CVE-2025-54535 was published Jul 28, 2025
Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e... High Unreviewed
CVE-2025-41256 was published Jun 26, 2025
The application uses a weak password hash function, allowing an attacker to crack the weak... Moderate Unreviewed
CVE-2025-49197 was published Jun 12, 2025
Due to outdated Hash algorithm, HCL Glovius Cloud could allow attackers to guess the input data... Moderate Unreviewed
CVE-2024-23589 was published May 30, 2025
The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up... Low Unreviewed
CVE-2025-48931 was published May 28, 2025
IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6... Moderate Unreviewed
CVE-2024-38341 was published May 28, 2025
The devices are vulnerable to an authentication bypass due to flaws in the authorization... Critical Unreviewed
CVE-2025-41652 was published May 27, 2025
pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting Moderate
CVE-2024-47829 was published for pnpm (npm) Apr 23, 2025
kexinoh
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4... Moderate Unreviewed
CVE-2025-3576 was published Apr 15, 2025
Jujutsu does not have SHA-1 collision detection Moderate
GHSA-794x-2rpg-rfgr was published for jj-cli (Rust) Apr 7, 2025
emilazy
gitoxide does not detect SHA-1 collision attacks Moderate
CVE-2025-31130 was published for gitoxide (Rust) Apr 4, 2025
emilazy EliahKagan
The device uses a weak hashing alghorithm to create the password hash. Hence, a matching password... Critical Unreviewed
CVE-2025-27595 was published Mar 14, 2025
A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote... Moderate Unreviewed
CVE-2024-10026 was published Jan 30, 2025
Web installer integrity check used weak hash algorithm. The following products are affected:... Moderate Unreviewed
CVE-2024-56414 was published Jan 2, 2025
Beego has Collision Hazards of MD5 in Cache Key Filenames Moderate
CVE-2024-55885 was published for github.com/beego/beego (Go) Dec 12, 2024
kexinoh
MD5 Checksum Bypass vulnerabilities where found exploiting a weakness in the way an application... High Unreviewed
CVE-2024-48847 was published Dec 5, 2024
MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow Moderate
CVE-2024-48924 was published for MessagePack (NuGet) Oct 17, 2024
AArnott neuecc
GrabYourPitchforks
Dozzle uses unsafe hash for passwords Low
CVE-2024-47182 was published for github.com/amir20/dozzle (Go) Oct 9, 2024
mohammed90
Certain switch models from PLANET Technology use an insecure hashing function to hash user... Moderate Unreviewed
CVE-2024-8453 was published Sep 30, 2024
Beego privilege escalation vulnerability High
CVE-2024-40465 was published for github.com/beego/beego/v2 (Go) Jul 31, 2024
An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to... Moderate Unreviewed
CVE-2024-32211 was published May 1, 2024
Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can... Moderate Unreviewed
CVE-2024-1040 was published Feb 2, 2024
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database