Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,163
Rust
1,615
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

2,497 advisories

Loading
AIOHTTP: File descriptor exhaustion in multipart requests High
CVE-2026-111066 was published for aiohttp (pip) Oct 20, 2026
nemoola Credited to nemoola and Dreamsorcerer Dreamsorcerer Dreamsorcerer
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory High
CVE-2026-113658 was published for apostrophe (npm) Oct 20, 2026
bp0lr Credited to bp0lr
ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS Moderate
CVE-2026-113656 was published for @apostrophecms/form (npm) Oct 20, 2026
chaitanyaeshwarprasad Credited to chaitanyaeshwarprasad
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) High
CVE-2026-111751 was published for @angular/router (npm) Oct 20, 2026
SkyZeroZx Credited to SkyZeroZx, atscott, and alan-agius4 atscott atscott
alan-agius4 alan-agius4
Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits... High Unreviewed
CVE-2026-105297 was published Oct 20, 2026
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage... Moderate Unreviewed
CVE-2025-36061 was published Oct 20, 2026
Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for... Critical Unreviewed
CVE-2026-112779 was published Oct 19, 2026
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental... Unknown Unreviewed
CVE-2026-110678 was published Oct 19, 2026
IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by... Moderate Unreviewed
CVE-2026-14511 was published Oct 19, 2026
aiohttp server lacks an initial request/header timeout High
CVE-2026-111064 was published for aiohttp (pip) Oct 19, 2026
tatulea Credited to tatulea and Dreamsorcerer Dreamsorcerer Dreamsorcerer
aiohttp: Multiple instances of excessive or unbounded memory/CPU use High
GHSA-2g87-pp6c-29x5 was published for aiohttp (pip) Oct 19, 2026
alimony Credited to alimony, EpicLiem, axel-mierczuk-1pw, afldl, iamibi, denyspakizh-tob, rodrigobnogueira, and Dreamsorcerer EpicLiem EpicLiem
axel-mierczuk-1pw axel-mierczuk-1pw afldl afldl iamibi iamibi denyspakizh-tob denyspakizh-tob rodrigobnogueira rodrigobnogueira Dreamsorcerer Dreamsorcerer
russh: Unbounded memory allocation in agent protocol server via crafted constraint records Moderate
CVE-2026-111061 was published for russh (Rust) Oct 19, 2026
Tan-JunWei Credited to Tan-JunWei
SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory... High Unreviewed
CVE-2026-112270 was published Oct 19, 2026
SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode... High Unreviewed
CVE-2026-112269 was published Oct 19, 2026
Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an... Unknown Unreviewed
CVE-2026-108837 was published Oct 19, 2026
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per... High Unreviewed
CVE-2026-110752 was published Oct 17, 2026
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability... Moderate Unreviewed
CVE-2026-85231 was published Oct 16, 2026
An unauthenticated remote attacker may use an allocation of resources without limits or... High Unreviewed
CVE-2026-107564 was published Oct 16, 2026
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail... Moderate Unreviewed
CVE-2026-16251 was published Oct 16, 2026
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10... Moderate Unreviewed
CVE-2026-19867 was published Oct 16, 2026
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file... High Unreviewed
CVE-2026-111384 was published Oct 16, 2026
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows... High Unreviewed
CVE-2026-111383 was published Oct 16, 2026
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized... High Unreviewed
CVE-2026-109468 was published Oct 15, 2026
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation Moderate
CVE-2026-102682 was published for pipecat-ai (pip) Oct 15, 2026
infycore Credited to infycore and agent-kira agent-kira agent-kira
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression Moderate
CVE-2026-100350 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
matiasinsaurralde Credited to matiasinsaurralde
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database