Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

37,294 advisories

Loading
vllm p2p never connected zmq_exhaustion Moderate
CVE-2026-94624 was published for vllm (pip) Oct 27, 2026
yyymk Credited to yyymk and jperezdealgaba jperezdealgaba jperezdealgaba
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs High
CVE-2026-115924 was published for rembg (pip) Oct 27, 2026
rach1tarora Credited to rach1tarora
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation Low
CVE-2026-83813 was published for Twisted (pip) Oct 27, 2026
tinyb0y Credited to tinyb0y
Ghost: Authorization Bypass in Comment Like Feature Moderate
CVE-2026-103288 was published for ghost (npm) Oct 27, 2026
assakafpix Credited to assakafpix and Buggs777 Buggs777 Buggs777
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files Moderate
CVE-2026-60083 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 27, 2026
alham-rizvi Credited to alham-rizvi
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()' Moderate
CVE-2026-114610 was published for fpdf2 (pip) Oct 27, 2026
Dev-Winty Credited to Dev-Winty
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content Moderate
CVE-2026-114609 was published for fpdf2 (pip) Oct 27, 2026
BudongJW Credited to BudongJW, redyank, and manop55555 redyank redyank
manop55555 manop55555
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation High
CVE-2026-102554 was published for com.google.guava:guava (Maven) Oct 27, 2026
kemrec Credited to kemrec
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall` Critical
CVE-2026-35002 was published for agno (pip) Oct 27, 2026
harshsinha03 Credited to harshsinha03
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow High
CVE-2026-49272 was published for oauthlib (pip) Oct 27, 2026
hekhuisk Credited to hekhuisk
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) Critical
CVE-2026-48705 was published for monai (pip) Oct 27, 2026
cldrn Credited to cldrn
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS Low
CVE-2026-46350 was published for dcmjs (npm) Oct 27, 2026
cldrn Credited to cldrn
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins High
CVE-2026-34157 was published for github.com/wailsapp/wails/v2 (Go) Oct 27, 2026
Saku0512 Credited to Saku0512
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter High
CVE-2026-33944 was published for dolibarr/dolibarr (Composer) Oct 27, 2026
F37I5H Credited to F37I5H
Ajenti has potential Remote Code Execution High
CVE-2026-27975 was published for aj (pip) Oct 27, 2026
kiarn Credited to kiarn and wcakir wcakir wcakir
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name Moderate
CVE-2026-112937 was published for filelock (pip) Oct 23, 2026
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database Low
CVE-2026-112913 was published for filelock (pip) Oct 23, 2026
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break Low
CVE-2026-112907 was published for filelock (pip) Oct 23, 2026
virtualenv: Temporary app-data can leave dangling seed package links Moderate
CVE-2026-113713 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Pip seeding with download omits wheel digest verification Low
CVE-2026-113717 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Downloaded wheel selection and caching precede verification Low
CVE-2026-113714 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Xonsh activation literals depend on the script decoding codec High
CVE-2026-113718 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Seeded files retain permissions from an older cache Moderate
CVE-2026-113720 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Bash prompt values can change meaning under older compatibility modes High
CVE-2026-113723 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Venv configuration readback can reinterpret path boundaries Low
CVE-2026-113715 was published for virtualenv (pip) Oct 23, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database