Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,163
Rust
1,615
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

2,497 advisories

Loading
OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket:... High Unreviewed
CVE-2026-118689 was published Oct 29, 2026
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Moderate
CVE-2026-115927 was published for tornado (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Moderate
CVE-2026-116577 was published for tornado (pip) Oct 28, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion Moderate
GHSA-2hw4-c9m4-f2fj was published for knative.dev/pkg (Go) Oct 28, 2026
tonghuaroot Credited to tonghuaroot
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length High
CVE-2026-116584 was published for seroval (npm) Oct 28, 2026
llegomark Credited to llegomark
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine Moderate
CVE-2026-115913 was published for vllm (pip) Oct 28, 2026
C1ves Credited to C1ves and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs Moderate
CVE-2026-115918 was published for vllm (pip) Oct 28, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool Moderate
CVE-2026-115911 was published for vllm (pip) Oct 28, 2026
oran-s Credited to oran-s and jperezdealgaba jperezdealgaba jperezdealgaba
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) Moderate
CVE-2026-116579 was published for autobahn (pip) Oct 28, 2026
adriank31 Credited to adriank31
MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by... Unknown Unreviewed
CVE-2026-116273 was published Oct 28, 2026
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of... Unknown Unreviewed
CVE-2026-117501 was published Oct 28, 2026
HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart... Unknown Unreviewed
CVE-2026-116134 was published Oct 28, 2026
HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an... Unknown Unreviewed
CVE-2026-116131 was published Oct 28, 2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release... Moderate Unreviewed
CVE-2026-92665 was published Oct 28, 2026
LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious... High Unreviewed
CVE-2026-118374 was published Oct 28, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation Moderate
CVE-2026-116694 was published for opentelemetry-propagator-jaeger (pip) Oct 27, 2026
tonghuaroot Credited to tonghuaroot
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering Moderate
CVE-2026-109932 was published for undici (npm) Oct 27, 2026
benzdeus Credited to benzdeus, UlisesGascon, and mcollina UlisesGascon UlisesGascon
mcollina mcollina
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length High
GHSA-f897-62hf-6gxq was published for @modelcontextprotocol/hono (npm) Oct 27, 2026
cybercraftsolutionsllc Credited to cybercraftsolutionsllc, hewei-gikaku, Jvr2022, Gal3m, mohammad228, shmulc8, JustasMonkev, and subchat hewei-gikaku hewei-gikaku
Jvr2022 Jvr2022 Gal3m Gal3m mohammad228 mohammad228 shmulc8 shmulc8 JustasMonkev JustasMonkev subchat subchat
Go JOSE: DoS when parsing JWKs that contain RSA keys High
CVE-2026-116587 was published for github.com/go-jose/go-jose/v3 (Go) Oct 27, 2026
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. Moderate Unreviewed
CVE-2026-116659 was published Oct 27, 2026
Tanium addressed a denial of service vulnerability in Enforce. Moderate Unreviewed
CVE-2026-116657 was published Oct 27, 2026
Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension. Moderate Unreviewed
CVE-2026-108309 was published Oct 27, 2026
Tanium addressed a denial of service vulnerability in Tanium Server. Moderate Unreviewed
CVE-2026-108310 was published Oct 27, 2026
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0... Moderate Unreviewed
CVE-2026-54462 was published Oct 27, 2026
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. Low
GHSA-h2v8-394m-p7vv was published for rustls (Rust) Oct 27, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database