GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
Filter advisories
Filter advisories
GitHub reviewed advisories
All reviewed
5,000+
Composer
4,251
Erlang
31
GitHub Actions
21
Go
2,018
Maven
5,000+
npm
3,725
NuGet
662
pip
3,400
Pub
11
RubyGems
890
Rust
861
Swift
36
Unreviewed advisories
All unreviewed
5,000+
34 advisories
Filter by severity
aiohttp-session creates non-expiring sessions
High
CVE-2018-1000814
was published
for
aiohttp-session
(pip)
Dec 20, 2018
Apache NiFi user log out issue
High
CVE-2019-12421
was published
for
org.apache.nifi:nifi-web-api
(Maven)
Dec 2, 2019
Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
High
CVE-2020-15269
was published
for
spree
(RubyGems)
Oct 20, 2020
Insufficient Session Expiration in Kiali
High
CVE-2020-1762
was published
for
github.com/kiali/kiali
(Go)
May 18, 2021
Invalid session token expiration
High
CVE-2021-32923
was published
for
github.com/hashicorp/vault
(Go)
Jun 8, 2021
Insufficient Session Expiration in OpenStack Keystone
High
CVE-2020-12690
was published
for
keystone
(pip)
Jun 9, 2021
Insufficient Session Expiration in @cyyynthia/tokenize
High
GHSA-jcjx-c3j3-44pr
was published
for
@cyyynthia/tokenize
(npm)
Nov 10, 2021
Insufficient Session Expiration in Sylius
High
CVE-2022-24743
was published
for
sylius/sylius
(Composer)
Mar 14, 2022
Insufficient Session Expiration in Admidio
High
CVE-2022-0991
was published
for
admidio/admidio
(Composer)
Mar 20, 2022
Old sessions not blocked by login enable function in Snipe-IT
High
CVE-2022-1155
was published
for
snipe/snipe-it
(Composer)
Mar 31, 2022
Keycloak insufficient session expiration
High
CVE-2021-3461
was published
for
org.keycloak:keycloak-parent
(Maven)
Apr 3, 2022
Insufficient Session Expiration in Jenkins
High
CVE-2019-1003049
was published
for
org.jenkins-ci.main:jenkins-core
(Maven)
May 13, 2022
Keycloak CSRF Vulnerability
High
CVE-2017-12159
was published
for
org.keycloak:keycloak-parent
(Maven)
May 13, 2022
OpenStack Keystone Domain-scoped tokens don't get revoked
High
CVE-2014-5253
was published
for
keystone
(pip)
May 17, 2022
OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events
High
CVE-2014-5251
was published
for
keystone
(pip)
May 17, 2022
OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events
High
CVE-2014-5252
was published
for
keystone
(pip)
May 17, 2022
Camaleon CMS Insufficient Session Expiration vulnerability
High
CVE-2021-25970
was published
for
camaleon_cms
(RubyGems)
May 24, 2022
Insufficient Session Expiration in NocoDB
High
CVE-2022-2064
was published
for
nocodb
(npm)
Jun 14, 2022
Insufficient Session Expiration in Nakama
High
CVE-2022-2306
was published
for
github.com/heroiclabs/nakama
(Go)
Jul 6, 2022
Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API
High
CVE-2022-41672
was published
for
apache-airflow
(pip)
Oct 7, 2022
rdiffweb vulnerable to Insufficient Session Expiration
High
CVE-2022-3362
was published
for
rdiffweb
(pip)
Nov 15, 2022
Insufficient Session Expiration in Jenkins Azure AD Plugin
High
CVE-2023-24426
was published
for
org.jenkins-ci.plugins:azure-ad
(Maven)
Jan 26, 2023
vantage6 refresh tokens do not expire
High
CVE-2023-23929
was published
for
vantage6
(pip)
Feb 28, 2023
Insufficient Session Expiration in pretix
High
CVE-2023-27891
was published
for
pretix
(pip)
Mar 7, 2023
Answer vulnerable to Insufficient Session Expiration
High
CVE-2023-1543
was published
for
github.com/answerdev/answer
(Go)
Mar 21, 2023
ProTip!
Advisories are also available from the
GraphQL API