GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
Filter advisories
Filter advisories
GitHub reviewed advisories
All reviewed
5,000+
Composer
4,732
Erlang
35
GitHub Actions
29
Go
2,310
Maven
5,000+
npm
3,949
NuGet
711
pip
3,728
Pub
12
RubyGems
920
Rust
964
Swift
38
Unreviewed advisories
All unreviewed
5,000+
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.
136 advisories
Filter by severity
A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX`...
Moderate
Unreviewed
CVE-2025-23167
was published
May 19, 2025
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow...
Moderate
Unreviewed
CVE-2025-47905
was published
May 14, 2025
Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass...
Critical
Unreviewed
CVE-2024-56523
was published
May 12, 2025
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct...
High
Unreviewed
CVE-2024-33452
was published
Apr 22, 2025
Apache Traffic Server allows request smuggling if chunked messages are malformed.
This...
High
Unreviewed
CVE-2024-53868
was published
Apr 3, 2025
IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack...
Moderate
Unreviewed
CVE-2022-39163
was published
Mar 26, 2025
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via...
Moderate
Unreviewed
CVE-2025-30346
was published
Mar 21, 2025
HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers...
High
Unreviewed
CVE-2024-10264
was published
Mar 20, 2025
In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible
Moderate
Unreviewed
CVE-2025-29904
was published
Mar 12, 2025
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in...
Critical
Unreviewed
CVE-2025-1867
was published
Mar 3, 2025
In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the...
Moderate
Unreviewed
CVE-2024-56908
was published
Feb 14, 2025
A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access...
Moderate
Unreviewed
CVE-2025-0752
was published
Jan 28, 2025
In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to...
Critical
Unreviewed
CVE-2023-29476
was published
Dec 14, 2024
Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in...
Moderate
Unreviewed
CVE-2024-53008
was published
Nov 28, 2024
GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0'...
High
Unreviewed
CVE-2024-52530
was published
Nov 11, 2024
Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services...
Moderate
Unreviewed
CVE-2024-21281
was published
Oct 15, 2024
An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service(DoS) via a crafted request.
High
Unreviewed
CVE-2024-44775
was published
Oct 15, 2024
An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture...
High
Unreviewed
CVE-2024-8912
was published
Oct 11, 2024
In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request...
Moderate
Unreviewed
CVE-2024-34535
was published
Oct 3, 2024
Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Moderate
Unreviewed
CVE-2024-42342
was published
Sep 8, 2024
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack...
Moderate
Unreviewed
CVE-2024-27185
was published
Aug 20, 2024
Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards...
High
Unreviewed
CVE-2023-38522
was published
Jul 26, 2024
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can...
Critical
Unreviewed
CVE-2024-35161
was published
Jul 26, 2024
This vulnerability allows a high-privileged authenticated PAM user to achieve remote command...
High
Unreviewed
CVE-2024-38494
was published
Jul 15, 2024
A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to...
Moderate
Unreviewed
CVE-2016-15039
was published
Jul 11, 2024
ProTip!
Advisories are also available from the
GraphQL API