CVE Program partner

GitHub_M

GitHub, Inc.

API
CVEs, 365 days12,45621,963 all time, 583 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationGitHub, Inc.
RoleCNA
TypeVendor, Open Source, Researcher
Reports tomitre
ScopeCVEs requested by code owners using the GitHub Security Advisories feature and vulnerabilities affecting open source projects discovered by security researchers at GitHub or Microsoft not covered by another CNA’s scope.
Advisorieshttps://github.com/advisories

Latest CVEs · RSS

  • CVE-2026-111044 2026-10-16 · CVSS 7.6
    Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a
  • CVE-2026-108372 2026-10-16 · CVSS 7.1
    Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, `loopx serve-
  • CVE-2026-49410 2026-10-16 · CVSS 8.1
    OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against t
  • CVE-2026-96627 2026-10-16 · CVSS 8.8
    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordH
  • CVE-2026-96628 2026-10-16 · CVSS 4.3
    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token c
  • CVE-2026-96626 2026-10-16 · CVSS 8.5
    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/co
  • CVE-2026-64862 2026-10-16 · CVSS 6.5
    Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistentl
  • CVE-2026-55796 2026-10-16 · CVSS 6.5
    Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report condit
  • CVE-2026-108373 2026-10-16 · CVSS 6.5
    ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summa
  • CVE-2026-108374 2026-10-16 · CVSS 7.7
    ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce pr
  • CVE-2026-102834 2026-10-16 · CVSS 7.5
    JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity withou
  • CVE-2026-96620 2026-10-16 · CVSS 9.2
    Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a d
  • CVE-2026-30971 2026-10-16 · CVSS 8.8
    ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated m
  • CVE-2026-102608 2026-10-16 · CVSS 9.0
    ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in singl
  • CVE-2026-102607 2026-10-16 · CVSS 8.8
    ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-control
  • CVE-2026-59970 2026-10-16 · CVSS 7.7
    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI prov
  • CVE-2026-61726 2026-10-16 · CVSS 8.1
    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter o
  • CVE-2026-59966 2026-10-16 · CVSS 5.7
    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regula
  • CVE-2026-59963 2026-10-16 · CVSS 7.1
    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Spa
  • CVE-2026-59962 2026-10-16 · CVSS 6.5
    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_fi
  • CVE-2026-59967 2026-10-16 · CVSS 5.4
    Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential p
  • CVE-2026-49868 2026-10-16 · CVSS 9.8
    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in
  • CVE-2026-102693 2026-10-16 · CVSS 9.6
    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 dri
  • CVE-2026-102692 2026-10-16 · CVSS 9.1
    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts o
  • CVE-2026-62362 2026-10-16 · CVSS 4.9
    PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/stati

All CVE Program partners