Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,163
Rust
1,615
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

941 advisories

Loading
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Moderate
CVE-2026-115927 was published for tornado (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Moderate
CVE-2026-116577 was published for tornado (pip) Oct 28, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion Moderate
GHSA-2hw4-c9m4-f2fj was published for knative.dev/pkg (Go) Oct 28, 2026
tonghuaroot Credited to tonghuaroot
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length High
CVE-2026-116584 was published for seroval (npm) Oct 28, 2026
llegomark Credited to llegomark
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine Moderate
CVE-2026-115913 was published for vllm (pip) Oct 28, 2026
C1ves Credited to C1ves and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs Moderate
CVE-2026-115918 was published for vllm (pip) Oct 28, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool Moderate
CVE-2026-115911 was published for vllm (pip) Oct 28, 2026
oran-s Credited to oran-s and jperezdealgaba jperezdealgaba jperezdealgaba
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) Moderate
CVE-2026-116579 was published for autobahn (pip) Oct 28, 2026
adriank31 Credited to adriank31
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation Moderate
CVE-2026-116694 was published for opentelemetry-propagator-jaeger (pip) Oct 27, 2026
tonghuaroot Credited to tonghuaroot
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering Moderate
CVE-2026-109932 was published for undici (npm) Oct 27, 2026
benzdeus Credited to benzdeus, UlisesGascon, and mcollina UlisesGascon UlisesGascon
mcollina mcollina
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length High
GHSA-f897-62hf-6gxq was published for @modelcontextprotocol/hono (npm) Oct 27, 2026
cybercraftsolutionsllc Credited to cybercraftsolutionsllc, hewei-gikaku, Jvr2022, Gal3m, mohammad228, shmulc8, JustasMonkev, and subchat hewei-gikaku hewei-gikaku
Jvr2022 Jvr2022 Gal3m Gal3m mohammad228 mohammad228 shmulc8 shmulc8 JustasMonkev JustasMonkev subchat subchat
Go JOSE: DoS when parsing JWKs that contain RSA keys High
CVE-2026-116587 was published for github.com/go-jose/go-jose/v3 (Go) Oct 27, 2026
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. Low
GHSA-h2v8-394m-p7vv was published for rustls (Rust) Oct 27, 2026
snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha High
CVE-2026-108106 was published for org.xerial.snappy:snappy-java (Maven) Oct 27, 2026
1seal Credited to 1seal, EndlssNightmare, taer, apvxlab, August829, and trnguyencflt EndlssNightmare EndlssNightmare
taer taer apvxlab apvxlab August829 August829 trnguyencflt trnguyencflt
vllm p2p never connected zmq_exhaustion Moderate
CVE-2026-94624 was published for vllm (pip) Oct 27, 2026
yyymk Credited to yyymk and jperezdealgaba jperezdealgaba jperezdealgaba
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation High
CVE-2026-102554 was published for com.google.guava:guava (Maven) Oct 27, 2026
kemrec Credited to kemrec
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser Moderate
CVE-2026-109924 was published for undici (npm) Oct 23, 2026
iamibi Credited to iamibi, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
Echo: BodyDump captures request and response bodies without size limits in v4 High
CVE-2026-118260 was published for github.com/labstack/echo/v4 (Go) Oct 23, 2026
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer High
CVE-2026-115776 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer High
CVE-2026-115778 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree High
CVE-2026-115775 was published for Twisted (pip) Oct 23, 2026
arkmarta Credited to arkmarta
pypdf: Possible large memory usage when parsing content streams Moderate
CVE-2026-113791 was published for pypdf (pip) Oct 22, 2026
scanleale Credited to scanleale and stefan6419846 stefan6419846 stefan6419846
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() High
CVE-2026-114144 was published for toml (npm) Oct 22, 2026
Zywexx Credited to Zywexx
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit High
CVE-2026-75508 was published for graphql-core (pip) Oct 22, 2026
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database