Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,581
Rust
21

2,512 advisories

Loading
vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio... High Unreviewed
CVE-2026-114052 was published Oct 21, 2026
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for... Moderate Unreviewed
CVE-2026-96405 was published Oct 21, 2026
The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from... High Unreviewed
CVE-2026-56387 was published Oct 21, 2026
The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and... High Unreviewed
CVE-2026-58064 was published Oct 21, 2026
Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on... High Unreviewed
CVE-2026-74757 was published Oct 21, 2026
Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1... High Unreviewed
CVE-2026-80463 was published Oct 21, 2026
Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that... High Unreviewed
CVE-2026-78066 was published Oct 21, 2026
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export High
CVE-2026-113711 was published for @apostrophecms/import-export (npm) Oct 21, 2026
kaizhi888 Credited to kaizhi888 and bp0lr bp0lr bp0lr
Pydantic AI Harness tool-call limit bypass in nested CodeMode calls Moderate
CVE-2026-114386 was published for pydantic-ai-harness (pip) Oct 21, 2026
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization High
CVE-2026-113729 was published for github.com/moov-io/signedxml (Go) Oct 21, 2026
shuji-oh Credited to shuji-oh
pypdf: Possible large memory usage for streams with multiple filters Moderate
CVE-2026-113795 was published for pypdf (pip) Oct 21, 2026
priyankn Credited to priyankn and stefan6419846 stefan6419846 stefan6419846
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold... Moderate Unreviewed
CVE-2026-76289 was published Oct 22, 2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to... Low Unreviewed
CVE-2026-114723 was published Oct 22, 2026
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows... High Unreviewed
CVE-2026-96365 was published Oct 22, 2026
Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style... Moderate Unreviewed
CVE-2026-96377 was published Oct 22, 2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource... Moderate Unreviewed
CVE-2026-114731 was published Oct 22, 2026
Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox... High Unreviewed
CVE-2026-105270 was published Oct 22, 2026
Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml... High Unreviewed
CVE-2026-86696 was published Oct 22, 2026
Next.js: Denial of Service in App Router using Server Actions High
CVE-2026-94482 was published for next (npm) Oct 22, 2026
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode Moderate
CVE-2026-96638 was published for pillow (pip) Oct 22, 2026
sonicnew Credited to sonicnew, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit High
CVE-2026-75508 was published for graphql-core (pip) Oct 22, 2026
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() High
CVE-2026-114144 was published for toml (npm) Oct 22, 2026
Zywexx Credited to Zywexx
pypdf: Possible large memory usage when parsing content streams Moderate
CVE-2026-113791 was published for pypdf (pip) Oct 22, 2026
scanleale Credited to scanleale and stefan6419846 stefan6419846 stefan6419846
An excessive resource allocation issue in the remote workflow editing capabilities of KNIME... Moderate Unreviewed
CVE-2026-115454 was published Oct 22, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database