GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Moderate
GHSA-2mjx-qc3c-rqvc
was published
for
rustls
(Rust)
Oct 5, 2026
Wagtail: Improper restriction handling on Page translation API endpoint
Moderate
GHSA-jm5p-837g-rv8g
was published
for
wagtail
(pip)
Aug 20, 2026
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
High
CVE-2026-54167
was published
for
github.com/openshift-pipelines/pipelines-as-code
(Go)
Aug 20, 2026
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
Critical
CVE-2026-55107
was published
for
kobako
(RubyGems)
Aug 18, 2026
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
High
CVE-2026-69097
was published
for
gitpython
(pip)
Jul 24, 2026
Docling: Unsafe URI and Path Handling in HTML Backend
High
CVE-2026-47214
was published
for
docling
(pip)
Jun 3, 2026
Pillow has a heap buffer overflow with nested list coordinates
Moderate
CVE-2026-42309
was published
for
pillow
(pip)
May 4, 2026
ProTip!
Advisories are also available from the
GraphQL API