Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

6,755 advisories

Loading
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer High
CVE-2026-115778 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree High
CVE-2026-115775 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value Moderate
CVE-2026-115877 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine Moderate
CVE-2026-114050 was published for vllm (pip) Oct 23, 2026
C1ves Credited to C1ves, JSGforever, and jperezdealgaba JSGforever JSGforever
jperezdealgaba jperezdealgaba
Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive High
GHSA-8cqv-vvq2-6p8c was published for mistune (pip) Oct 22, 2026 • withdrawn
virtualenv: Generated files can follow existing destination links Moderate
CVE-2026-113721 was published for virtualenv (pip) Oct 22, 2026
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() High
GHSA-78g4-xqwv-q3g8 was published for pillow (pip) Oct 22, 2026
thesecguy45 Credited to thesecguy45
pypdf: Possible long runtimes/large memory usage when retrieving form fields Moderate
CVE-2026-113789 was published for pypdf (pip) Oct 22, 2026
adriank31 Credited to adriank31 and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible large memory usage when parsing arrays and dictionaries Moderate
CVE-2026-113790 was published for pypdf (pip) Oct 22, 2026
26627 Credited to 26627 and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible large memory usage when parsing content streams Moderate
CVE-2026-113791 was published for pypdf (pip) Oct 22, 2026
scanleale Credited to scanleale and stefan6419846 stefan6419846 stefan6419846
GitPython validates a submodule's ".git" path only after cloning into it (RCE) High
CVE-2026-114145 was published for Gitpython (pip) Oct 22, 2026
H1tr30xNull Credited to H1tr30xNull
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit High
CVE-2026-75508 was published for graphql-core (pip) Oct 22, 2026
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule High
CVE-2026-75507 was published for graphql-core (pip) Oct 22, 2026
bcmyguest Credited to bcmyguest
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc High
CVE-2026-114140 was published for nbconvert (pip) Oct 22, 2026
Yann-P Credited to Yann-P, y011d4, HOHK0923, toannguyen3107, NovaHunter06, mohammedix88, and martinRenou y011d4 y011d4
HOHK0923 HOHK0923 toannguyen3107 toannguyen3107 NovaHunter06 NovaHunter06 mohammedix88 mohammedix88 martinRenou martinRenou
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api Moderate
CVE-2026-114603 was published for opentelemetry-api (pip) Oct 22, 2026
pi3ch Credited to pi3ch
Black: GitHub Action installs unvalidated required-version from pyproject.toml High
CVE-2026-114134 was published for black (pip) Oct 22, 2026
jiteshgulati Credited to jiteshgulati
Django REST framework: TokenProxy.delete() reports success and revokes nothing High
CVE-2026-114137 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation High
CVE-2026-114138 was published for djangorestframework (pip) Oct 22, 2026
jisung-02 Credited to jisung-02
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer High
CVE-2026-96778 was published for Pillow (pip) Oct 22, 2026
carlini Credited to carlini
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) High
CVE-2026-96644 was published for Pillow (pip) Oct 22, 2026
MegaManSec Credited to MegaManSec
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time High
CVE-2026-96643 was published for Pillow (pip) Oct 22, 2026
0xSmiley Credited to 0xSmiley and radarhere radarhere radarhere
Pillow: TarIO negative size field causes infinite CPU-spin loop High
CVE-2026-96642 was published for Pillow (pip) Oct 22, 2026
0xSmiley Credited to 0xSmiley and radarhere radarhere radarhere
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise Moderate
CVE-2026-96641 was published for pillow (pip) Oct 22, 2026
Mengxi-Xu Credited to Mengxi-Xu, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion High
CVE-2026-96640 was published for Pillow (pip) Oct 22, 2026
mfazrinizar Credited to mfazrinizar
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database