Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
3,941
Erlang
29
GitHub Actions
16
Go
1,722
Maven
4,952
npm
3,481
NuGet
605
pip
3,049
Pub
10
RubyGems
832
Rust
778
Swift
34
Unreviewed advisories
All unreviewed
5,000+

45 advisories

Active Support Possibly Discloses Locally Encrypted Files Low
CVE-2023-38037 was published for activesupport (RubyGems) Aug 23, 2023
Insecure temporary file in the installer for Zoom Rooms before version 5.15.0 may allow an... High Unreviewed
CVE-2023-34119 was published Jul 11, 2023
Insecure Temporary File in HuTool High
CVE-2023-33695 was published for cn.hutool:hutool-core (Maven) Jun 13, 2023
transformers has Insecure Temporary File Moderate
CVE-2023-2800 was published for transformers (pip) May 18, 2023
sfblackl-intel
Java Merge-sort Insecure Temporary File vulnerability Moderate
CVE-2022-24913 was published for com.fasterxml.util:java-merge-sort (Maven) Jan 12, 2023
globalpom-utils has Insecure Temporary File Critical
CVE-2018-25068 was published for com.anrisoftware.globalpom:globalpomutils (Maven) Jan 6, 2023
A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This... High Unreviewed
CVE-2022-4817 was published Dec 28, 2022
A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is... Moderate Unreviewed
CVE-2022-4641 was published Dec 22, 2022
A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this... Moderate Unreviewed
CVE-2022-3969 was published Nov 13, 2022
ManyDesigns Portofino subject to creation of insecure temporary file High
CVE-2022-3952 was published for com.manydesigns:portofino (Maven) Nov 11, 2022
The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat... High Unreviewed
CVE-2013-4253 was published Oct 19, 2022
ansible-runner 2.0.0 vulnerable to Race Condition Moderate
CVE-2021-3702 was published for ansible-runner (pip) Aug 24, 2022
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot High
CVE-2022-27772 was published for org.springframework.boot:spring-boot (Maven) Jul 11, 2022
trgpa JLLeitschuh
A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5,... Low Unreviewed
CVE-2021-25316 was published May 24, 2022
A Insecure Temporary File vulnerability in the packaging of cyrus-sasl of openSUSE Factory allows... High Unreviewed
CVE-2020-8032 was published May 24, 2022
A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS,... Moderate Unreviewed
CVE-2020-8027 was published May 24, 2022
A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers... Moderate Unreviewed
CVE-2020-8030 was published May 24, 2022
phpMyAdmin unsafely handles temporary files High
CVE-2008-7252 was published for phpmyadmin/phpmyadmin (Composer) May 17, 2022
Insecure Temporary File in Jinja2 Moderate
CVE-2014-0012 was published for Jinja2 (pip) May 17, 2022
RPLY Predictable Tmpfile Names Allows Cache Spoofing Low
CVE-2014-1604 was published for RPLY (pip) May 17, 2022
Puppet uses predictable filenames, allowing arbitrary file overwrite Moderate
CVE-2012-1906 was published for puppet (RubyGems) May 14, 2022
instack-undercloud vulnerable to symlink attack on tmp files Moderate
CVE-2017-7549 was published for instack-undercloud (pip) May 13, 2022
ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name Low
CVE-2013-0162 was published for ruby_parser (RubyGems) May 5, 2022
golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym... Critical Unreviewed
CVE-2012-2666 was published Apr 23, 2022
Hadoop symlink vulnerability High
CVE-2012-2945 was published for org.apache.hadoop:hadoop-main (Maven) Apr 23, 2022
ProTip! Advisories are also available from the GraphQL API