Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

7,201 advisories

Loading
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user High
CVE-2026-106451 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError Low
CVE-2026-106449 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs Moderate
CVE-2026-106450 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers Moderate
CVE-2026-106122 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
ba-am Credited to ba-am
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() Moderate
CVE-2026-106123 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
sonicnew Credited to sonicnew, mark-adams, HonorableSudoku, and xnuinside mark-adams mark-adams
HonorableSudoku HonorableSudoku xnuinside xnuinside
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header Moderate
CVE-2026-106452 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat Credited to yawkat
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError Moderate
CVE-2026-106453 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Snowflake drivers writes sensitive information to logs Moderate
CVE-2026-86597 was published for github.com/snowflakedb/gosnowflake (Go) Oct 5, 2026
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path Critical
CVE-2026-103922 was published for @capacitor/android (Maven) Oct 5, 2026
andredestro Credited to andredestro
Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution High
CVE-2026-61586 was published for eu.copernik:copernik-xml-factory (Maven) Oct 2, 2026
thientd Credited to thientd and gladiator9797 gladiator9797 gladiator9797
jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS) High
CVE-2026-89425 was published for com.fasterxml.jackson.core:jackson-core (Maven) Oct 1, 2026
manqingzhou Credited to manqingzhou
jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() High
CVE-2026-89407 was published for com.fasterxml.jackson.core:jackson-core (Maven) Oct 1, 2026
manqingzhou Credited to manqingzhou
jackson-databind quadratic forward-reference completion High
CVE-2026-91777 was published for com.fasterxml.jackson.core:jackson-databind (Maven) Sep 30, 2026
dabirt Credited to dabirt
jackson-databind retains every unknown raw type ID High
CVE-2026-91776 was published for com.fasterxml.jackson.core:jackson-databind (Maven) Sep 30, 2026
dabirt Credited to dabirt
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist) Moderate
CVE-2026-83557 was published for com.fasterxml.jackson.core:jackson-databind (Maven) Sep 28, 2026
prvazsahnazarov Credited to prvazsahnazarov
jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS High
CVE-2026-68497 was published for com.fasterxml.jackson.core:jackson-databind (Maven) Sep 28, 2026
waydeshi Credited to waydeshi
jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution Moderate
CVE-2026-19032 was published for com.fasterxml.jackson.core:jackson-databind (Maven) Sep 28, 2026
waydeshi Credited to waydeshi
jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserialization Moderate
CVE-2026-77310 was published for com.fasterxml.jackson.core:jackson-databind (Maven) Sep 28, 2026
thientd Credited to thientd and pussycat0x pussycat0x pussycat0x
http4s-scala-xml has an XML External Entity (XXE) processing issue Critical
CVE-2026-61741 was published for org.http4s:http4s-scala-xml_2.12 (Maven) Sep 24, 2026
rossabaker Credited to rossabaker and samspills samspills samspills
Jawn: Quadratic parsing effort in AsyncParser High
CVE-2026-61814 was published for org.typelevel:jawn-parser_2.12 (Maven) Sep 23, 2026
rossabaker Credited to rossabaker and samspills samspills samspills
Jawn: Uncontrolled nesting depth in JSON parser High
CVE-2026-59990 was published for org.typelevel:jawn-parser_2.12 (Maven) Sep 23, 2026
rossabaker Credited to rossabaker and eed3si9n eed3si9n eed3si9n
JLine: ReDoS in Nano Editor Regex Search Mode Moderate
CVE-2026-77421 was published for org.jline:jline-builtins (Maven) Sep 23, 2026
sectroyer Credited to sectroyer
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping High
CVE-2026-77422 was published for org.jline:jline-builtins (Maven) Sep 23, 2026
sectroyer Credited to sectroyer
JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable Moderate
CVE-2026-77420 was published for org.jline:jline-reader (Maven) Sep 23, 2026
sectroyer Credited to sectroyer
Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug Critical
CVE-2026-85724 was published for io.moquette:moquette-broker (Maven) Sep 23, 2026
gigioneggiando Credited to gigioneggiando, stanleys12, and muhammedalikcb stanleys12 stanleys12
muhammedalikcb muhammedalikcb
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database