CVEs published by GitHub, Inc.

CVEs published by GitHub, Inc. (CVE Numbering Authority). 756 tracked.

• CVE-2026-106110 HIGH 7.5 UPGRADE ImageSharp is a 2D graphics library
• CVE-2026-106111 MEDIUM 5.9 UPGRADE ImageSharp is a 2D graphics library
• CVE-2026-106112 HIGH 7.5 UPGRADE ImageSharp is a 2D graphics library
• CVE-2026-106113 HIGH 7.5 UPGRADE ImageSharp is a 2D graphics library
• CVE-2026-106114 MEDIUM 5.3 UPGRADE ImageSharp is a 2D graphics library
• CVE-2026-106115 HIGH 7.5 UPGRADE ImageSharp is a 2D graphics library
• CVE-2026-106116 MEDIUM 5.3 UPGRADE ImageSharp is a 2D graphics library
• CVE-2026-34977 CRITICAL 9.8 UPGRADE Aperi'Solve is an open-source steganalysis web platform
• CVE-2026-35047 CRITICAL 9.8 UPGRADE Brave CMS is an open-source CMS
• CVE-2026-54735 CRITICAL 10.0 UPGRADE Prebid Server is an open-source solution for running real-time advertising auctions in the cloud
• CVE-2026-62325 CRITICAL 9.1 goshs is a feature-rich single-binary file server for red teamers and developers
• CVE-2026-35052 CRITICAL 9.8 UPGRADE D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures
• CVE-2026-35029 HIGH 8.8 UPGRADE LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
• CVE-2026-64863 CRITICAL 9.1 goshs is a feature-rich single-binary file server for red teamers and developers
• CVE-2026-54725 CRITICAL 9.6 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible
• CVE-2026-35050 CRITICAL 9.1 UPGRADE text-generation-webui is an open-source web interface for running Large Language Models
• CVE-2026-54653 HIGH 8.8 UPGRADE datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI
• CVE-2026-69253 HIGH 8.8 UPGRADE Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows
• CVE-2026-69254 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-71479 CRITICAL 9.1 New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system
• CVE-2026-55389 HIGH 7.5 UPGRADE datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI
• CVE-2026-69250 HIGH 7.5 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-34783 HIGH 8.1 UPGRADE Ferret is a declarative system for working with web data
• CVE-2026-54078 HIGH 8.7 veraPDF validation model is an implementation of the veraPDF validation model
• CVE-2026-54079 HIGH 8.7 veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair
• CVE-2026-56671 HIGH 7.5 ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface
• CVE-2026-55100 HIGH 8.7 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API
• CVE-2026-69252 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-34989 CRITICAL 9.0 UPGRADE CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC a
• CVE-2026-35044 HIGH 8.8 UPGRADE BentoML is a Python library for building online serving systems optimized for AI apps and model inference
• CVE-2026-54650 HIGH 8.6 openhole exposes localhost to the internet in one command
• CVE-2026-54729 HIGH 8.7 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks
• CVE-2026-53510 HIGH 8.1 Savon is a Ruby SOAP client
• CVE-2026-34841 CRITICAL 9.8 UPGRADE Bruno is an open source IDE for exploring and testing APIs
• CVE-2026-54603 HIGH 8.6 OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC)
• CVE-2026-54609 HIGH 8.6 QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library
• CVE-2026-52855 CRITICAL 9.9 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel
• CVE-2026-34969 HIGH 7.5 UPGRADE Nhost is an open source Firebase alternative with GraphQL
• CVE-2026-34986 HIGH 7.5 UPGRADE Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, inc
• CVE-2026-54635 HIGH 7.5 pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchai
• CVE-2026-59933 HIGH 7.5 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-59932 HIGH 7.5 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-54638 HIGH 7.5 gotd/td is a T Telegram MTProto API client in Go
• CVE-2026-56673 HIGH 7.5 ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface
• CVE-2026-52856 HIGH 7.5 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel
• CVE-2026-54690 HIGH 8.2 UPGRADE datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI
• CVE-2026-55390 HIGH 7.5 datamodel-code-generator generates Python data models from schema definitions
• CVE-2026-55391 HIGH 7.5 UPGRADE datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI
• CVE-2026-55415 HIGH 7.5 UPGRADE datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI
• CVE-2026-73851 MEDIUM 6.1 Kiota is an OpenAPI based HTTP Client code generator
• CVE-2026-35045 HIGH 8.1 UPGRADE Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists
• CVE-2026-44016 HIGH 8.2 UPGRADE Docling simplifies document processing by parsing diverse formats and providing integrations with the generati
• CVE-2026-49258 HIGH 8.8 Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN
• CVE-2026-47219 HIGH 7.5 find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and supports route parame
• CVE-2026-54719 HIGH 7.5 goshs is a feature-rich single-binary file server for red teamers and developers
• CVE-2026-35039 CRITICAL 9.1 UPGRADE fast-jwt provides fast JSON Web Token (JWT) implementation
• CVE-2026-48025 MEDIUM 6.9 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-54659 MEDIUM 6.9 Pagy is agnostic pagination in plain Ruby
• CVE-2026-54080 MEDIUM 6.9 veraPDF PDF parser is a PDF parser for veraPDF
• CVE-2026-54081 MEDIUM 6.9 veraPDF PDF parser is a PDF parser for veraPDF
• CVE-2026-54737 HIGH 7.3 @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency
• CVE-2026-54661 HIGH 8.3 swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification
• CVE-2026-54662 HIGH 8.3 swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications
• CVE-2026-54664 HIGH 8.3 swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification
• CVE-2026-54666 HIGH 8.3 swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification
• CVE-2026-35167 HIGH 7.1 UPGRADE Kedro is a toolbox for production-ready data science
• CVE-2026-59931 HIGH 7.7 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2023-30549 HIGH 7.1 UPGRADE MITIGATE Apptainer is an open source container platform for Linux
• CVE-2026-35043 HIGH 7.8 UPGRADE BentoML is a Python library for building online serving systems optimized for AI apps and model inference
• CVE-2026-48060 HIGH 8.1 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework
• CVE-2026-56670 HIGH 8.2 ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface
• CVE-2026-56672 HIGH 8.2 ComfyUI is a node-based diffusion model GUI, API, and backend
• CVE-2026-53599 HIGH 7.5 REDAXO is a PHP-based content management system
• CVE-2026-54656 HIGH 7.8 UPGRADE datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI
• CVE-2026-54691 HIGH 8.2 datamodel-code-generator generates Python data models from schema definitions
• CVE-2026-54082 MEDIUM 6.5 veraPDF validation model is an implementation of the veraPDF validation model
• CVE-2026-62999 HIGH 7.5 Copier is a library and CLI app for rendering project templates
• CVE-2026-54909 MEDIUM 5.3 pion/stun is a Go implementation of STUN
• CVE-2026-54660 HIGH 7.4 swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications
• CVE-2026-66063 MEDIUM 6.5 goshs is a feature-rich single-binary file server for red teamers and developers
• CVE-2026-47726 HIGH 7.1 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-66064 MEDIUM 5.3 goshs is a feature-rich single-binary file server for red teamers and developers
• CVE-2026-54605 HIGH 7.2 OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers
• CVE-2026-47725 MEDIUM 6.9 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-49447 MEDIUM 5.3 Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, a
• CVE-2026-54621 HIGH 7.8 datamodel-code-generator generates Python data models from schema definitions
• CVE-2026-54654 HIGH 7.8 datamodel-code-generator generates Python data models from schema definitions
• CVE-2026-54655 HIGH 7.8 datamodel-code-generator generates Python data models from schema definitions
• CVE-2026-65841 MEDIUM 5.3 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor
• CVE-2026-53573 MEDIUM 4.8 GeoNetwork is a catalog application to manage spatially referenced resources
• CVE-2026-50558 MEDIUM 5.9 Penelope Shell Handler is a post-exploitation shell handler for authorized security testing
• CVE-2026-48058 MEDIUM 4.6 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-54663 MEDIUM 6.1 swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications
• CVE-2026-62324 MEDIUM 5.4 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor
• CVE-2026-55403 LOW 3.7 datamodel-code-generator generates Python data models from schema definitions
• CVE-2026-54785 MEDIUM 6.2 gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI
• CVE-2026-47768 MEDIUM 5.5 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network
• CVE-2026-52857 MEDIUM 5.5 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel
• CVE-2023-31135 LOW 3.3 UPGRADE Dgraph is an open source distributed GraphQL database
• CVE-2026-54787 LOW 3.1 sigstore-go is a Go library for Sigstore signing and verification
• CVE-2026-54619 LOW 2.0 sqlite3 provides Ruby bindings for the SQLite3 embedded database
• CVE-2026-54620 LOW 2.0 sqlite3 provides Ruby bindings for the SQLite3 embedded database
• CVE-2026-96643 HIGH 7.1 Pillow is a Python imaging library
• CVE-2026-96637 HIGH 7.1 Pillow is a Python imaging library
• CVE-2026-75507 HIGH 7.5 GraphQL-core is a Python port of the GraphQL.js reference implementation
• CVE-2026-115897 LOW 2.1 Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and
• CVE-2026-115895 HIGH 8.8 Happy DOM is a JavaScript implementation of a web browser without its graphical user interface
• CVE-2026-115893 CRITICAL 9.9 Wasmtime is a runtime for WebAssembly
• CVE-2026-115892 MEDIUM 5.7 Wasmtime is a runtime for WebAssembly
• CVE-2026-115889 CRITICAL 9.9 Wasmtime is a runtime for WebAssembly
• CVE-2026-115887 HIGH 7.5 GraphQL Scalars is a library of custom GraphQL scalars for creating precise type-safe GraphQL schemas
• CVE-2026-115886 MEDIUM 6.5 MLflow is an open source AI engineering platform for agents, large language models, and machine learning model
• CVE-2026-115885 MEDIUM 4.1 The LangGraph CLI is the official command-line interface for LangGraph
• CVE-2026-115883 MEDIUM 6.0 LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and
• CVE-2026-114508 MEDIUM 6.5 Laravel is a web application framework
• CVE-2026-114141 HIGH 8.7 toml-node is a TOML parser for Node.js and the browser
• CVE-2026-108358 HIGH 8.8 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-108357 HIGH 8.8 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-68502 CRITICAL 9.8 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework
• CVE-2026-68503 CRITICAL 9.8 LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework
• CVE-2026-54722 HIGH 8.7 DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks
• CVE-2026-47754 CRITICAL 9.3 Metacat is data repository software that helps researchers preserve, share, and discover data
• CVE-2026-55768 HIGH 8.7 GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or thr
• CVE-2026-68500 HIGH 7.5 Sylius Mollie Plugin provides Mollie payment integration for Sylius applications
• CVE-2026-62663 HIGH 7.5 Banks generates meaningful LLM prompts using a simple template language
• CVE-2026-62246 HIGH 8.5 Kamaji is the Hosted Control Plane Manager for Kubernetes
• CVE-2026-59952 MEDIUM 6.9 Valibot helps validate data using a schema
• CVE-2026-59881 MEDIUM 6.9 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
• CVE-2026-68501 MEDIUM 6.5 Sylius Mollie Plugin provides Mollie payment integration for Sylius applications
• CVE-2026-65834 MEDIUM 6.8 Capsule is a multi-tenancy and policy-based framework for Kubernetes
• CVE-2025-66020 HIGH 7.5 Valibot helps validate data using a schema
• CVE-2026-61536 HIGH 7.5 Banks generates meaningful LLM prompts using a simple template language
• CVE-2026-67527 HIGH 7.6 OpenProject is open-source, web-based project management software
• CVE-2026-65835 MEDIUM 6.6 Capsule is a multi-tenancy and policy-based framework for Kubernetes
• CVE-2026-54715 HIGH 7.1 GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or thr
• CVE-2026-55777 MEDIUM 5.3 GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or thr
• CVE-2026-61526 MEDIUM 6.1 AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework
• CVE-2026-62845 MEDIUM 4.7 Kamaji is the Hosted Control Plane Manager for Kubernetes
• CVE-2026-54522 MEDIUM 5.4 UPGRADE MessagePack for Ruby is an implementation of the MessagePack binary serialization format
• CVE-2026-67530 MEDIUM 6.4 WACRM is a self-hostable CRM template for WhatsApp
• CVE-2026-64870 MEDIUM 5.3 MaxKB is an open-source AI assistant for enterprise
• CVE-2025-59042 HIGH 7.0 PyInstaller bundles a Python application and all its dependencies into a single package
• CVE-2026-67529 MEDIUM 4.3 OpenProject is open-source, web-based project management software
• CVE-2026-68499 MEDIUM 6.2 re2 provides Node.js bindings for Google's RE2 regular expression engine
• CVE-2026-67528 MEDIUM 4.3 OpenProject is open-source, web-based project management software
• CVE-2026-67550 MEDIUM 5.7 re2 provides Node.js bindings for Google's RE2 regular expression engine
• CVE-2026-83813 LOW 3.1 Twisted is an event-based framework for internet applications, supporting Python 3.6+
• CVE-2026-75525 MEDIUM 5.3 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform
• CVE-2026-75524 MEDIUM 5.4 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform
• CVE-2026-65825 HIGH 7.5 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform

← Back to latest CVEs