GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
5 advisories
Subsonic API: any authenticated user can delete or read any other user's playlist (IDOR)
High
CVE-2026-49338
was published
for
go.senan.xyz/gonic
(Go)
Jun 26, 2026
gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host
High
CVE-2026-49340
was published
for
go.senan.xyz/gonic
(Go)
Jun 26, 2026
Tilt: Missing authentication on the network-exposed Tilt HUD server
Critical
CVE-2026-55884
was published
for
github.com/tilt-dev/tilt
(Go)
Jun 19, 2026
Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream
High
CVE-2026-55883
was published
for
github.com/tilt-dev/tilt
(Go)
Jun 19, 2026
Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
High
CVE-2026-55882
was published
for
github.com/tilt-dev/tilt
(Go)
Jun 19, 2026
ProTip!
Advisories are also available from the
GraphQL API