Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,163
Rust
1,615
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

941 advisories

Loading
Containerd has image-pull DoS via crafted OCI index graph amplification Moderate
CVE-2026-53493 was published for github.com/containerd/containerd (Go) Sep 25, 2026
jake-ciolek Credited to jake-ciolek, mayank-jangid-moon, Kushalkhemka, skigeek16, and opensec-intelligence mayank-jangid-moon mayank-jangid-moon
Kushalkhemka Kushalkhemka skigeek16 skigeek16 opensec-intelligence opensec-intelligence
Jawn: Uncontrolled nesting depth in JSON parser High
CVE-2026-59990 was published for org.typelevel:jawn-parser_2.12 (Maven) Sep 23, 2026
rossabaker Credited to rossabaker and eed3si9n eed3si9n eed3si9n
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) High
CVE-2026-86065 was published for github.com/klever-io/klever-go (Go) Sep 23, 2026
ch4r0utf8 Credited to ch4r0utf8
Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service Moderate
CVE-2026-61541 was published for zapros (pip) Sep 23, 2026
Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb) High
CVE-2026-61652 was published for zapros (pip) Sep 23, 2026
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service High
CVE-2026-77633 was published for github.com/cloudreve/Cloudreve/v4 (Go) Sep 22, 2026
newugly Credited to newugly
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation Moderate
CVE-2026-77528 was published for autobahn (pip) Sep 22, 2026
hibrian827 Credited to hibrian827
Duplicate Advisory: vllm p2p never connected zmq_exhaustion High
GHSA-8qpc-6rxx-4pxf was published for vllm (pip) Sep 22, 2026 • withdrawn
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware High
CVE-2026-61629 was published for github.com/lucasdillmann/nginx-ignition (Go) Sep 21, 2026
tonghuaroot Credited to tonghuaroot and lucasdillmann lucasdillmann lucasdillmann
AnyIO process-pool workers can block indefinitely on undrained stderr Moderate
CVE-2026-64847 was published for anyio (pip) Sep 18, 2026
Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass Moderate
CVE-2026-77281 was published for github.com/caddyserver/caddy/v2 (Go) Sep 18, 2026
WhiskerEnt Credited to WhiskerEnt
CoreDNS: Unauthenticated memory exhaustion in custom transports High
CVE-2026-82399 was published for github.com/coredns/coredns (Go) Sep 17, 2026
thevilledev Credited to thevilledev
Svelte devalue: DoS via malformed input Moderate
CVE-2026-81176 was published for devalue (npm) Sep 17, 2026
Rich-Harris Credited to Rich-Harris, kq5y, and elliott-with-the-longest-name-on-github kq5y kq5y
elliott-with-the-longest-name-on-github elliott-with-the-longest-name-on-github
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation Moderate
CVE-2026-69147 was published for vllm (pip) Sep 17, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation High
CVE-2026-77403 was published for github.com/rabbitmq/amqp091-go (Go) Sep 17, 2026
suchitd Credited to suchitd
RabbitMQ Java client has frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement High
CVE-2026-75516 was published for com.rabbitmq:amqp-client (Maven) Sep 17, 2026
lucianjohnhouse Credited to lucianjohnhouse
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions Moderate
CVE-2026-57173 was published for vllm (pip) Sep 16, 2026
koonnamchok Credited to koonnamchok, DarkLight1337, and jperezdealgaba DarkLight1337 DarkLight1337
jperezdealgaba jperezdealgaba
Http4s Ember HTTP/2: unbounded continuation frame accumulation High
CVE-2026-69218 was published for org.http4s:http4s-ember-core_2.12 (Maven) Sep 15, 2026
rossabaker Credited to rossabaker, samspills, morgen-peschke, and reardonj samspills samspills
morgen-peschke morgen-peschke reardonj reardonj
Http4s Ember HTTP/2 has an unbounded outbound frame queue High
CVE-2026-69213 was published for org.http4s:http4s-ember-core_2.12 (Maven) Sep 15, 2026
reardonj Credited to reardonj and rossabaker rossabaker rossabaker
Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS High
CVE-2026-69203 was published for org.http4s:http4s-ember-core_2.12 (Maven) Sep 15, 2026
reardonj Credited to reardonj and rossabaker rossabaker rossabaker
Http4s Ember HTTP/2: unbounded inbound body buffering High
CVE-2026-69202 was published for org.http4s:http4s-ember-core_2.12 (Maven) Sep 15, 2026
rossabaker Credited to rossabaker and reardonj reardonj reardonj
Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API High
GHSA-c2g7-39fr-cp8q was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout High
CVE-2026-87011 was published for open-webui (pip) Sep 10, 2026
galanko Credited to galanko and Classic298 Classic298 Classic298
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded Moderate
CVE-2026-88012 was published for github.com/traefik/traefik/v2 (Go) Sep 10, 2026
ShadMalloy Credited to ShadMalloy
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint High
CVE-2026-86075 was published for n8n (npm) Sep 10, 2026
Masofgon Credited to Masofgon
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database