Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

72 advisories

Loading
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) Moderate
CVE-2026-110816 was published for qs (npm) Oct 27, 2026
manus-pi Credited to manus-pi, Lucidsec, and manus-use Lucidsec Lucidsec
manus-use manus-use
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading Moderate
CVE-2026-108360 was published for phpoffice/phpspreadsheet (Composer) Oct 27, 2026
manus-use Credited to manus-use, alimony, arpitjain099, nikolakojic-rasit, and manus-pi alimony alimony
arpitjain099 arpitjain099 nikolakojic-rasit nikolakojic-rasit manus-pi manus-pi
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage High
GHSA-3w55-933p-8pv5 was published for strands-agents (pip) Oct 27, 2026
manus-use Credited to manus-use
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution High
GHSA-f9j4-qggq-h239 was published for GitPython (pip) Oct 27, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service Moderate
GHSA-4ffr-jq9g-5ffx was published for nodemailer (npm) Oct 27, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service Moderate
GHSA-4g23-2xm8-66gc was published for nodemailer (npm) Oct 27, 2026
manus-use Credited to manus-use
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment High
GHSA-j456-xh4h-cpf2 was published for nltk (pip) Oct 27, 2026
manus-use Credited to manus-use
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options() High
GHSA-q54r-jf2p-rfr2 was published for gix (Rust) Oct 23, 2026
manus-use Credited to manus-use
Electron: Pointer lock permission requests can be attributed to the wrong frame Moderate
CVE-2026-113798 was published for electron (npm) Oct 22, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes Critical
GHSA-cg2g-xh64-v4q7 was published for dompurify (npm) Oct 22, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing Moderate
CVE-2026-110871 was published for nodemailer (npm) Oct 22, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service Moderate
CVE-2026-114129 was published for stream-json (npm) Oct 22, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF Moderate
CVE-2026-113671 was published for @apostrophecms/ai-helper (npm) Oct 20, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization Moderate
CVE-2026-113655 was published for apostrophe (npm) Oct 20, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service High
CVE-2026-113666 was published for @apostrophecms/db-connect (npm) Oct 20, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) High
CVE-2026-96627 was published for github.com/getarcaneapp/arcane/backend/v2 (Go) Oct 16, 2026
manus-use Credited to manus-use
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path Moderate
CVE-2026-100347 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
manus-use Credited to manus-use
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure High
CVE-2026-76216 was published for code.vikunja.io/api (Go) Oct 9, 2026
manus-use Credited to manus-use and zuhairhalawa zuhairhalawa zuhairhalawa
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host Moderate
GHSA-p3pr-8f3m-4qp8 was published for pyload-ng (pip) Oct 9, 2026
manus-pi Credited to manus-pi, manus-use, eprogressing, and zuhairhalawa manus-use manus-use
eprogressing eprogressing zuhairhalawa zuhairhalawa
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled High
CVE-2026-107227 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method High
CVE-2026-106440 was published for hydra-optuna-sweeper (pip) Oct 7, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup High
CVE-2026-102600 was published for @socket.io/cluster-engine (npm) Oct 5, 2026
manus-use Credited to manus-use
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit Critical
CVE-2026-92934 was published for vm2 (npm) Oct 5, 2026
manus-use Credited to manus-use and maru1009 maru1009 maru1009
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass Critical
CVE-2026-8505 was published for langflow (pip) Oct 5, 2026
AntonioABLima Credited to AntonioABLima, windbreaker555, manus-use, l3tchupkt, andifilhohub, and erichare windbreaker555 windbreaker555
manus-use manus-use l3tchupkt l3tchupkt andifilhohub andifilhohub erichare erichare
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path Moderate
CVE-2026-59944 was published for composer/composer (Composer) Oct 2, 2026
DavidCarliez Credited to DavidCarliez, manus-use, and arpitjain099 manus-use manus-use
arpitjain099 arpitjain099
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database