GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
GitHub reviewed advisories
Unreviewed advisories
7 advisories
Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry
Moderate
GHSA-7rx3-28cr-v5wh
was published
for
handlebars
(npm)
Mar 29, 2026
Handlebars.js has a Property Access Validation Bypass in container.lookup
Low
GHSA-442j-39wm-28r2
was published
for
handlebars
(npm)
Mar 29, 2026
fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections
Moderate
CVE-2026-3635
was published
for
fastify
(npm)
Mar 25, 2026
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
High
CVE-2026-30925
was published
for
parse-server
(npm)
Mar 10, 2026
Mercurius's queryDepth limit bypassed for WebSocket subscriptions
Low
CVE-2026-30241
was published
for
mercurius
(npm)
Mar 6, 2026
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag
Low
CVE-2026-30830
was published
for
defuddle
(npm)
Mar 6, 2026
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
High
CVE-2026-30827
was published
for
express-rate-limit
(npm)
Mar 6, 2026
ProTip!
Advisories are also available from the
GraphQL API