Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,583
Rust
21

281 advisories

Loading
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) Moderate
CVE-2026-110816 was published for qs (npm) Oct 27, 2026
manus-pi Credited to manus-pi, Lucidsec, manus-use, and KeenSecurityLab Lucidsec Lucidsec
manus-use manus-use KeenSecurityLab KeenSecurityLab
Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKittyOS beam_mcp... Low Unreviewed
CVE-2026-104634 was published Oct 8, 2026
vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features Moderate
CVE-2026-105754 was published for vllm (pip) Oct 5, 2026
KernelClint Credited to KernelClint and jperezdealgaba jperezdealgaba jperezdealgaba
Zebra before 6.3.0 contains a protection mechanism failure that allows unauthenticated peers to... Moderate Unreviewed
CVE-2026-104420 was published Oct 2, 2026
A vulnerability in the certification authentication feature of Internet Key Exchange version 2 ... High Unreviewed
CVE-2026-20249 was published Sep 16, 2026
Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics,... Moderate Unreviewed
CVE-2026-86348 was published Sep 14, 2026
Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010... Moderate Unreviewed
CVE-2026-87546 was published Sep 9, 2026
In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper... Critical Unreviewed
CVE-2026-58822 was published Sep 8, 2026
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting... High Unreviewed
CVE-2026-28609 was published Sep 8, 2026
Incorrect type conversion or cast in Microsoft Windows Search Component allows an authorized... High Unreviewed
CVE-2026-69585 was published Sep 8, 2026
Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to validate... Moderate Unreviewed
CVE-2026-10080 was published Aug 18, 2026
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type... Critical Unreviewed
CVE-2026-15826 was published Aug 15, 2026
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could... High Unreviewed
CVE-2026-6726 was published Aug 11, 2026
Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS) Moderate
CVE-2026-73429 was published for russh (Rust) Jul 24, 2026
Zhaodl1 Credited to Zhaodl1
node-tar: Process crash via PAX numeric path type confusion Moderate
CVE-2026-59871 was published for tar (npm) Jul 20, 2026
homanp Credited to homanp
Incorrect type conversion or cast in Windows Notification allows an authorized attacker to... High Unreviewed
CVE-2026-50337 was published Jul 14, 2026
Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking High
CVE-2026-55076 was published for github.com/coder/coder/v2 (Go) Jul 6, 2026
golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic High
CVE-2026-46597 was published for golang.org/x/crypto (Go) Jun 25, 2026
unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race Moderate
CVE-2026-46690 was published for unbounded-spsc (Rust) May 29, 2026
berkant-koc Credited to berkant-koc
Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer... Moderate Unreviewed
CVE-2023-7345 was published May 20, 2026
OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages High
CVE-2026-45685 was published for go.opentelemetry.io/obi (Go) May 18, 2026
MrAlias Credited to MrAlias
free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request) Moderate
CVE-2026-44324 was published for github.com/free5gc/udr (Go) May 8, 2026
LinZiyuu Credited to LinZiyuu
vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters Moderate
CVE-2026-44223 was published for vllm (pip) May 6, 2026
Yunzez Credited to Yunzez
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery Moderate
CVE-2026-42576 was published for chainguard.dev/apko (Go) May 4, 2026
1seal Credited to 1seal, antitree, and markusthoemmes antitree antitree
markusthoemmes markusthoemmes
Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may... Moderate Unreviewed
CVE-2021-4456 was published Feb 27, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database