Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

20 advisories

Loading
Sandbox escape via various forms of "format". High
CVE-2023-41039 was published for RestrictedPython (pip) Aug 30, 2023
ankush Credited to ankush, abhishekg999, d-maurer, icemac, and Quasar0147 abhishekg999 abhishekg999
d-maurer d-maurer icemac icemac Quasar0147 Quasar0147
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration High
CVE-2023-33234 was published for apache-airflow-providers-cncf-kubernetes (pip) Jul 6, 2023
Langchain Server-Side Request Forgery vulnerability High
CVE-2023-32786 was published for langchain (pip) Oct 21, 2023
eyurtsev Credited to eyurtsev
RCE in TranformGraph().to_dot_graph function High
CVE-2023-41334 was published for astropy (pip) Mar 18, 2024
u32i Credited to u32i
Reddit Terminal Viewer (RTV) vulnerable to argument injection attacks High
CVE-2017-17516 was published for rtv (pip) May 14, 2022
Withdrawn Advisory: Litestar has an environment Variable injection in `docs-preview.yml` workflow High
CVE-2024-42370 was published for litestar (pip) Aug 9, 2024 • withdrawn
pwntester Credited to pwntester and JacobCoffee JacobCoffee JacobCoffee
Denial of service attack via incorrect parameters in Matrix Synapse High
CVE-2020-26257 was published for matrix-synapse (pip) Dec 9, 2020
Remote Code Execution in Red Discord Bot High
CVE-2020-15147 was published for Red-DiscordBot (pip) Aug 21, 2020
Jackenmen Credited to Jackenmen
HTTP response splitting in uvicorn High
CVE-2020-7695 was published for uvicorn (pip) Jul 29, 2020
Ankitects Anki arbitrary script execution vulnerability High
CVE-2024-26020 was published for anki (pip) Jul 22, 2024
bee-san Credited to bee-san
D-Tale affected by Remote Code Execution through the /save-column-filter endpoint High
CVE-2026-27194 was published for dtale (pip) Feb 19, 2026
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters High
CVE-2025-61773 was published for pyload-ng (pip) Oct 9, 2025
odaysec Credited to odaysec
SAP Cloud SDK for AI Python has OS Command Injection when Program Objects Execution is Enabled High
CVE-2023-25617 was published for sap-ai-sdk-base (pip) Mar 14, 2023
Langroid: handle_message() executes user-supplied tool JSON without sender verification High
CVE-2026-54771 was published for langroid (pip) Jul 6, 2026
u-ktdi Credited to u-ktdi
yt-dlp: Arbitrary code execution via manifest downloads with aria2c High
CVE-2026-50574 was published for yt-dlp (pip) Jun 16, 2026
seproDev Credited to seproDev, Grub4K, and bashonly Grub4K Grub4K
bashonly bashonly
yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output High
CVE-2026-55404 was published for yt-dlp (pip) Jul 24, 2026
gamer191 Credited to gamer191 and bashonly bashonly bashonly
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE) High
GHSA-jm78-9fvv-mhgr was published for GitPython (pip) Aug 7, 2026
manus-use Credited to manus-use
Flawfinder output manipulation via untrusted filenames and source text High
CVE-2026-48813 was published for flawfinder (pip) Jun 26, 2026
Duplicate Advisory: GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE) High
GHSA-9xx9-hw38-h2w9 was published for gitpython (pip) Aug 3, 2026 • withdrawn
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE) High
CVE-2026-69097 was published for gitpython (pip) Jul 24, 2026
ranjiGT Credited to ranjiGT
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database