Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
39
GitHub Actions
38
Go
2,662
Maven
5,000+
npm
4,289
NuGet
760
pip
4,069
Pub
12
RubyGems
957
Rust
1,057
Swift
45
Unreviewed advisories
All unreviewed
5,000+

34 advisories

Loading
Backdrop CMS Host Header Injection vulnerability Moderate
CVE-2025-63828 was published for backdrop/backdrop (Composer) Nov 18, 2025
OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation High
CVE-2025-64484 was published for github.com/oauth2-proxy/oauth2-proxy/v7 (Go) Nov 12, 2025
47Cid
Credited to 47Cid
IBM OpenPages 9.0 and 9.1 is vulnerable to HTTP header injection, caused by improper validation... Moderate Unreviewed
CVE-2025-36223 was published Nov 12, 2025
The BigFix WebUI application responds with HOST information from the HTTP header field making it... Moderate Unreviewed
CVE-2025-52647 was published Oct 11, 2025
IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2... Moderate Unreviewed
CVE-2024-40686 was published Jul 23, 2025
HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By... Low Unreviewed
CVE-2025-40631 was published May 16, 2025
A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to... Moderate Unreviewed
CVE-2025-24339 was published Apr 30, 2025
IBM i 7.3, 7.4, 7.5, and 7.5 is vulnerable to a host header injection attack caused by improper... Moderate Unreviewed
CVE-2025-2950 was published Apr 21, 2025
IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to HTTP header injection, caused by... Moderate Unreviewed
CVE-2022-43847 was published Apr 14, 2025
IBM TXSeries for Multiplatforms 9.1 and 11.1 could disclose sensitive information to a remote... Moderate Unreviewed
CVE-2025-0154 was published Apr 2, 2025
A Host Header Injection vulnerability in TRMTracker application may allow an attacker by... Moderate Unreviewed
CVE-2025-27632 was published Mar 25, 2025
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper... Moderate Unreviewed
CVE-2023-35894 was published Mar 7, 2025
Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by... Low Unreviewed
CVE-2025-23191 was published Feb 11, 2025
A Host Header Injection vulnerability exists in CTFd 3.7.5, due to the application failing to... Moderate Unreviewed
CVE-2025-23001 was published Jan 31, 2025
IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By... Moderate Unreviewed
CVE-2024-51464 was published Dec 21, 2024
The HTTP host header can be manipulated and cause the application to behave in unexpected ways.... Moderate Unreviewed
CVE-2024-30129 was published Dec 6, 2024
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability Moderate
CVE-2024-10006 was published for github.com/hashicorp/consul (Go) Oct 31, 2024
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow... High Unreviewed
CVE-2024-47549 was published Oct 25, 2024
IBM Aspera Orchestrator 4.0.1 is vulnerable to HTTP header injection, caused by improper... Moderate Unreviewed
CVE-2023-26289 was published Jul 30, 2024
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header... Moderate Unreviewed
CVE-2024-39736 was published Jul 15, 2024
An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.... Critical Unreviewed
CVE-2024-22081 was published Mar 20, 2024
IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper... Moderate Unreviewed
CVE-2022-22399 was published Mar 5, 2024
Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security Moderate
CVE-2024-21499 was published for github.com/greenpau/caddy-security (Go) Feb 17, 2024
IBM Engineering Lifecycle Optimization 7.0.2 and 7.0.3 is vulnerable to HTTP header injection,... Moderate Unreviewed
CVE-2023-45190 was published Feb 9, 2024
A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a... High Unreviewed
CVE-2024-1064 was published Feb 3, 2024
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database