GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
Language support
Unreviewed advisories have not been assessed by GitHub for quality and do not connect to the Dependabot service.
Filter advisories
Filter advisories
GitHub reviewed advisories
All reviewed
5,000+
Composer
4,032
Erlang
29
GitHub Actions
18
Go
1,838
Maven
5,000+
npm
3,577
NuGet
634
pip
3,162
Pub
10
RubyGems
849
Rust
800
Swift
34
Unreviewed advisories
All unreviewed
5,000+
103 advisories
Filter by severity
Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs
Moderate
CVE-2014-3663
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 17, 2022
Jenkins improperly ensures trust separation
Moderate
CVE-2014-3665
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 17, 2022
Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Moderate
CVE-2014-3680
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 17, 2022
Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting
Moderate
CVE-2014-5325
was published
for
org.directwebremoting:dwr
(Maven)
May 17, 2022
Improper Input Validation in Apache ActiveMQ
Moderate
CVE-2015-6524
was published
for
org.apache.activemq:activemq-broker
(Maven)
May 17, 2022
Path Traversal in Eclipse Mojarra
Moderate
CVE-2013-3827
was published
for
org.glassfish:javax.faces
(Maven)
May 17, 2022
Loop with Unreachable Exit Condition in Apache POI
Moderate
CVE-2014-9527
was published
for
org.apache.poi:poi
(Maven)
May 17, 2022
Improper Authentication in Apache Hadoop
Moderate
CVE-2014-0229
was published
for
org.apache.hadoop:hadoop-common
(Maven)
May 17, 2022
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
Moderate
CVE-2011-5245
was published
for
org.jboss.resteasy:resteasy-jaxb-provider
(Maven)
May 17, 2022
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
Moderate
CVE-2012-0818
was published
for
org.jboss.resteasy:resteasy-client
(Maven)
May 17, 2022
Jenkins directory traversal vulnerability
Moderate
CVE-2014-2059
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 17, 2022
Jenkins cross-site scripting (XSS) vulnerability
Moderate
CVE-2014-2067
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 17, 2022
Improper Restriction of XML External Entity Reference in Apache POI
Moderate
CVE-2014-3529
was published
for
org.apache.poi:poi
(Maven)
May 17, 2022
Jenkins Path Traversal vulnerability
Moderate
CVE-2014-3664
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 17, 2022
Improper Input Validation in Apache POI
Moderate
CVE-2014-3574
was published
for
org.apache.poi:poi
(Maven)
May 17, 2022
Jenkins HttpOnly flag not Set for session cookies
Moderate
CVE-2014-9635
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 17, 2022
Jenkins secure flag not set on session cookies
Moderate
CVE-2014-9634
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 17, 2022
Denial of service in Apache Tomcat
Moderate
CVE-2014-0095
was published
for
org.apache.tomcat.embed:tomcat-embed-core
(Maven)
May 17, 2022
JBoss RichFaces Improper Input Validation vulnerability
Moderate
CVE-2014-0086
was published
for
org.richfaces:richfaces
(Maven)
May 17, 2022
Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
Moderate
CVE-2014-3604
was published
for
ca.juliusdavies:not-yet-commons-ssl
(Maven)
May 14, 2022
Improper Certificate Validation in vt-ldap
Moderate
CVE-2014-3607
was published
for
edu.internet2.middleware:shibboleth-identityprovider
(Maven)
May 14, 2022
Improper Neutralization of Input During Web Page Generation in Mojarra
Moderate
CVE-2013-5855
was published
for
org.glassfish:javax.faces
(Maven)
May 14, 2022
Improper Neutralization of Input During Web Page Generation in JAMon
Moderate
CVE-2013-6235
was published
for
com.jamonapi:jamon
(Maven)
May 14, 2022
Apache Syncope uses a weak PNRG
Moderate
CVE-2014-3503
was published
for
org.apache.syncope:syncope
(Maven)
May 14, 2022
Cross-site scripting in Elasticsearch
Moderate
CVE-2014-6439
was published
for
org.elasticsearch:elasticsearch
(Maven)
May 14, 2022
ProTip!
Advisories are also available from the
GraphQL API