Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

GitHub reviewed advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
40
GitHub Actions
38
Go
2,800
Maven
5,000+
npm
4,426
NuGet
773
pip
4,199
Pub
12
RubyGems
968
Rust
1,086
Swift
47
Unreviewed advisories
All unreviewed
5,000+

391 advisories

Loading
Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP... High Unreviewed
CVE-2025-4677 was published Jan 7, 2026
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version... Low Unreviewed
CVE-2025-31962 was published Jan 7, 2026
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced High
CVE-2025-68954 was published for github.com/pterodactyl/wings (Composer) Jan 6, 2026
real2two
Credited to real2two
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers... Moderate Unreviewed
CVE-2021-47740 was published Dec 31, 2025
SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration... Moderate Unreviewed
CVE-2022-50692 was published Dec 31, 2025
Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web... Low Unreviewed
CVE-2025-55254 was published Dec 17, 2025
HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP... Moderate Unreviewed
CVE-2025-62329 was published Dec 16, 2025
IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2... Moderate Unreviewed
CVE-2025-36360 was published Dec 15, 2025
django-allauth does not reject access tokens for inactive users Moderate
CVE-2025-65430 was published for django-allauth (pip) Dec 15, 2025
An insufficient session expiration vulnerability [CWE-613] in Fortinet FortiOS 7.4.0, FortiOS 7.2... Moderate Unreviewed
CVE-2025-62631 was published Dec 9, 2025
A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41)... High Unreviewed
CVE-2025-65883 was published Dec 4, 2025
nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout... High Unreviewed
CVE-2025-11699 was published Dec 1, 2025
authentik's invitation expiry is delayed by at least 5 minutes Moderate
CVE-2025-64708 was published for goauthentik.io (Go) Nov 19, 2025
melizeche
Credited to melizeche
The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is... Moderate Unreviewed
CVE-2025-63226 was published Nov 18, 2025
Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user... Critical Unreviewed
CVE-2025-56643 was published Nov 18, 2025
Flowise Fails to Invalidate Existing Sessions After Password Changes High
GHSA-x7rp-qj2h-ghgw was published for flowise (npm) Nov 14, 2025
mbiesiad
Credited to mbiesiad
The equipment grants a JWT token for each connection in the timeline, but during an active valid... High Unreviewed
CVE-2025-64386 was published Oct 31, 2025
Nagios Fusion versions prior to R2.1 contain a vulnerability due to the application not requiring... High Unreviewed
CVE-2025-34269 was published Oct 31, 2025
Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessions for a user... Critical Unreviewed
CVE-2024-13996 was published Oct 31, 2025
On affected platforms, if SSH session multiplexing was configured on the client side, SSH... Moderate Unreviewed
CVE-2025-54547 was published Oct 30, 2025
Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1... Moderate Unreviewed
CVE-2025-12278 was published Oct 26, 2025
Keycloak does not invalidate offline sessions when the offline_access scope is removed Moderate
CVE-2025-12110 was published for org.keycloak:keycloak-services (Maven) Oct 23, 2025
Keycloak does not invalidate sessions when "Remember Me" is disabled Moderate
CVE-2025-11429 was published for org.keycloak:keycloak-services (Maven) Oct 23, 2025
Strapi is vulnerable to Insufficient Session Expiration Moderate
CVE-2025-3930 was published for @strapi/strapi (npm) Oct 16, 2025
An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2... Moderate Unreviewed
CVE-2025-25252 was published Oct 14, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database