Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

485 advisories

Loading
pypdf has possible long runtimes/large memory usage for encrypted PDF files High
CVE-2026-119208 was published for pypdf (pip) Oct 30, 2026
DharmendraSoni5110 Credited to DharmendraSoni5110
pypdf has possible large memory usage when parsing cross-reference streams High
CVE-2026-119209 was published for pypdf (pip) Oct 30, 2026
PabloAlaniz Credited to PabloAlaniz
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset High
GHSA-vpp8-g58w-m8mp was published for Twisted (pip) Oct 29, 2026
arkmarta Credited to arkmarta
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length High
CVE-2026-116584 was published for seroval (npm) Oct 28, 2026
llegomark Credited to llegomark
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length High
GHSA-f897-62hf-6gxq was published for @modelcontextprotocol/hono (npm) Oct 27, 2026
cybercraftsolutionsllc Credited to cybercraftsolutionsllc, hewei-gikaku, Jvr2022, Gal3m, mohammad228, shmulc8, JustasMonkev, and subchat hewei-gikaku hewei-gikaku
Jvr2022 Jvr2022 Gal3m Gal3m mohammad228 mohammad228 shmulc8 shmulc8 JustasMonkev JustasMonkev subchat subchat
Go JOSE: DoS when parsing JWKs that contain RSA keys High
CVE-2026-116587 was published for github.com/go-jose/go-jose/v3 (Go) Oct 27, 2026
snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha High
CVE-2026-108106 was published for org.xerial.snappy:snappy-java (Maven) Oct 27, 2026
1seal Credited to 1seal, EndlssNightmare, taer, apvxlab, August829, and trnguyencflt EndlssNightmare EndlssNightmare
taer taer apvxlab apvxlab August829 August829 trnguyencflt trnguyencflt
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation High
CVE-2026-102554 was published for com.google.guava:guava (Maven) Oct 27, 2026
kemrec Credited to kemrec
Echo: BodyDump captures request and response bodies without size limits in v4 High
CVE-2026-118260 was published for github.com/labstack/echo/v4 (Go) Oct 23, 2026
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer High
CVE-2026-115776 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer High
CVE-2026-115778 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree High
CVE-2026-115775 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() High
CVE-2026-114144 was published for toml (npm) Oct 22, 2026
Zywexx Credited to Zywexx
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit High
CVE-2026-75508 was published for graphql-core (pip) Oct 22, 2026
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
Next.js: Denial of Service in App Router using Server Actions High
CVE-2026-94482 was published for next (npm) Oct 22, 2026
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization High
CVE-2026-113729 was published for github.com/moov-io/signedxml (Go) Oct 21, 2026
shuji-oh Credited to shuji-oh
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export High
CVE-2026-113711 was published for @apostrophecms/import-export (npm) Oct 21, 2026
kaizhi888 Credited to kaizhi888 and bp0lr bp0lr bp0lr
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation High
CVE-2026-111768 was published for @modelcontextprotocol/sdk (npm) Oct 20, 2026
root-Brainoverflow Credited to root-Brainoverflow
AIOHTTP: File descriptor exhaustion in multipart requests High
CVE-2026-111066 was published for aiohttp (pip) Oct 20, 2026
nemoola Credited to nemoola and Dreamsorcerer Dreamsorcerer Dreamsorcerer
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory High
CVE-2026-113658 was published for apostrophe (npm) Oct 20, 2026
bp0lr Credited to bp0lr
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) High
CVE-2026-111751 was published for @angular/router (npm) Oct 20, 2026
SkyZeroZx Credited to SkyZeroZx, atscott, and alan-agius4 atscott atscott
alan-agius4 alan-agius4
aiohttp server lacks an initial request/header timeout High
CVE-2026-111064 was published for aiohttp (pip) Oct 19, 2026
tatulea Credited to tatulea and Dreamsorcerer Dreamsorcerer Dreamsorcerer
aiohttp: Multiple instances of excessive or unbounded memory/CPU use High
GHSA-2g87-pp6c-29x5 was published for aiohttp (pip) Oct 19, 2026
alimony Credited to alimony, EpicLiem, axel-mierczuk-1pw, afldl, iamibi, denyspakizh-tob, rodrigobnogueira, and Dreamsorcerer EpicLiem EpicLiem
axel-mierczuk-1pw axel-mierczuk-1pw afldl afldl iamibi iamibi denyspakizh-tob denyspakizh-tob rodrigobnogueira rodrigobnogueira Dreamsorcerer Dreamsorcerer
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS High
CVE-2026-104827 was published for react/http (Composer) Oct 15, 2026
EQSTLab Credited to EQSTLab, WyriHaximus, and 232-323 WyriHaximus WyriHaximus
232-323 232-323
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database