Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

692 advisories

Loading
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep` High
CVE-2026-104852 was published for @graphql-tools/utils (npm) Oct 5, 2026
enisdenjo Credited to enisdenjo, tepel-chen, and ardatan tepel-chen tepel-chen
ardatan ardatan
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution Critical
CVE-2026-104848 was published for tinypool (npm) Oct 5, 2026
ambushneupane Credited to ambushneupane
Tinypool: Prototype Pollution Gadget to RCE in run() options Critical
CVE-2026-104849 was published for tinypool (npm) Oct 5, 2026
Fcmam5 Credited to Fcmam5
stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objects Moderate
CVE-2026-104183 was published for stream-json (npm) Oct 5, 2026
cruzryan Credited to cruzryan
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix Critical
CVE-2026-92953 was published for vm2 (npm) Oct 5, 2026
rexpository Credited to rexpository
@orpc/zod: Prototype injection in smart coercion Moderate
CVE-2026-103918 was published for @orpc/zod (npm) Oct 5, 2026
Improperly controlled modification of object prototype attributes ('prototype pollution')... Moderate Unreviewed
CVE-2026-86536 was published Oct 2, 2026
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion Moderate
GHSA-4q55-j62x-fr9h was published for devalue (npm) Oct 1, 2026
elliott-with-the-longest-name-on-github Credited to elliott-with-the-longest-name-on-github
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env Critical
CVE-2026-102992 was published for piscina (npm) Oct 1, 2026
Fcmam5 Credited to Fcmam5
Axios: Header Injection via Inherited headers After Minimal Interceptor Moderate
CVE-2026-101904 was published for axios (npm) Sep 30, 2026
0xEr3n Credited to 0xEr3n
Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders Moderate
CVE-2026-101900 was published for axios (npm) Sep 30, 2026
0xEr3n Credited to 0xEr3n
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection High
CVE-2026-101905 was published for axios (npm) Sep 30, 2026
DavidCarliez Credited to DavidCarliez
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin... Moderate Unreviewed
CVE-2026-91860 was published Sep 30, 2026
Axios: Prototype pollution gadget in fetch adapter can alter outbound requests Moderate
CVE-2026-101908 was published for axios (npm) Sep 30, 2026
iruizsalinas Credited to iruizsalinas
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method Moderate
CVE-2026-101902 was published for axios (npm) Sep 30, 2026
hash3liZer Credited to hash3liZer and eros938 eros938 eros938
Axios: Prototype Pollution Gadget in axios toFormData Options High
CVE-2026-101909 was published for axios (npm) Sep 30, 2026
chan154 Credited to chan154
scim-patch: Mutation of Inherited Built-in Method Objects Moderate
CVE-2026-61834 was published for scim-patch (npm) Sep 28, 2026
mountainousmolehill Credited to mountainousmolehill and Kairos-T Kairos-T Kairos-T
A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2... Moderate Unreviewed
CVE-2026-97724 was published Sep 25, 2026
CyberChef: Prototype pollution in Series Chart operation Moderate
CVE-2026-57439 was published for cyberchef (npm) Sep 24, 2026
hyuunnn Credited to hyuunnn
mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the... High Unreviewed
CVE-2026-97151 was published Sep 24, 2026
deepmerge mergeObject() allows prototype poisoning of returned objects Low
CVE-2026-93753 was published for deepmerge (npm) Sep 18, 2026
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution... High Unreviewed
CVE-2026-92779 was published Sep 16, 2026
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution... Moderate Unreviewed
CVE-2026-92781 was published Sep 16, 2026
joi messages compilation allows prototype replacement through __proto__ error codes Moderate
CVE-2026-90771 was published for joi (npm) Sep 13, 2026
yayson: Prototype pollution in Store/LegacyStore deserialization Critical
CVE-2026-61534 was published for yayson (npm) Sep 11, 2026
hackchang Credited to hackchang and jede jede jede
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database