GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
9 advisories
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Critical
CVE-2026-112393
was published
for
Pillow
(pip)
Oct 21, 2026
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
High
CVE-2026-112896
was published
for
Pillow
(pip)
Oct 20, 2026
Ghost: Remote Code Execution via Theme Translation Files
High
CVE-2026-105677
was published
for
ghost
(npm)
Oct 7, 2026
Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass
Moderate
CVE-2026-58442
was published
for
code.gitea.io/gitea
(Go)
Jul 21, 2026
Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories
High
CVE-2026-58423
was published
for
code.gitea.io/gitea
(Go)
Jul 21, 2026
Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware
High
CVE-2026-105782
was published
for
Scrapy
(pip)
Mar 13, 2026
Soft Serve is missing an authorization check in LFS lock deletion
Moderate
CVE-2026-22253
was published
for
github.com/charmbracelet/soft-serve
(Go)
Jan 8, 2026
Soft Serve is vulnerable to SSRF through its Webhooks
Critical
CVE-2025-64522
was published
for
github.com/charmbracelet/soft-serve
(Go)
Nov 10, 2025
Soft Serve does not sanitize ANSI escape sequences in user input
Moderate
CVE-2025-64494
was published
for
github.com/charmbracelet/soft-serve
(Go)
Nov 6, 2025
ProTip!
Advisories are also available from the
GraphQL API