Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,163
Rust
1,615
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

2,497 advisories

Loading
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit High
CVE-2026-75508 was published for graphql-core (pip) Oct 22, 2026
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode Moderate
CVE-2026-96638 was published for pillow (pip) Oct 22, 2026
sonicnew Credited to sonicnew, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Next.js: Denial of Service in App Router using Server Actions High
CVE-2026-94482 was published for next (npm) Oct 22, 2026
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml... High Unreviewed
CVE-2026-86696 was published Oct 22, 2026
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox... High Unreviewed
CVE-2026-105270 was published Oct 22, 2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource... Moderate Unreviewed
CVE-2026-114731 was published Oct 22, 2026
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style... Moderate Unreviewed
CVE-2026-96377 was published Oct 22, 2026
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows... High Unreviewed
CVE-2026-96365 was published Oct 22, 2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to... Low Unreviewed
CVE-2026-114723 was published Oct 22, 2026
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold... Moderate Unreviewed
CVE-2026-76289 was published Oct 22, 2026
pypdf: Possible large memory usage for streams with multiple filters Moderate
CVE-2026-113795 was published for pypdf (pip) Oct 21, 2026
priyankn Credited to priyankn and stefan6419846 stefan6419846 stefan6419846
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization High
CVE-2026-113729 was published for github.com/moov-io/signedxml (Go) Oct 21, 2026
shuji-oh Credited to shuji-oh
Pydantic AI Harness tool-call limit bypass in nested CodeMode calls Moderate
CVE-2026-114386 was published for pydantic-ai-harness (pip) Oct 21, 2026
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export High
CVE-2026-113711 was published for @apostrophecms/import-export (npm) Oct 21, 2026
kaizhi888 Credited to kaizhi888 and bp0lr bp0lr bp0lr
Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1... Unknown Unreviewed
CVE-2026-80463 was published Oct 21, 2026
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that... Unknown Unreviewed
CVE-2026-78066 was published Oct 21, 2026
Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on... High Unreviewed
CVE-2026-74757 was published Oct 21, 2026
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and... Unknown Unreviewed
CVE-2026-58064 was published Oct 21, 2026
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from... Unknown Unreviewed
CVE-2026-56387 was published Oct 21, 2026
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for... Moderate Unreviewed
CVE-2026-96405 was published Oct 21, 2026
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio... High Unreviewed
CVE-2026-114052 was published Oct 21, 2026
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit Moderate
CVE-2026-112899 was published for Pillow (pip) Oct 20, 2026
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation High
CVE-2026-111768 was published for @modelcontextprotocol/sdk (npm) Oct 20, 2026
root-Brainoverflow Credited to root-Brainoverflow
AIOHTTP: Connector pool exhaustion via Max-Age overflow Moderate
CVE-2026-111065 was published for aiohttp (pip) Oct 20, 2026
denyspakizh-tob Credited to denyspakizh-tob and Dreamsorcerer Dreamsorcerer Dreamsorcerer
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database