Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,581
Rust
21

1,167 advisories

Loading
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps High
CVE-2026-63414 was published for shopify_app (RubyGems) Oct 29, 2026
Crass: Non-ASCII characters cause superlinear CPU consumption Moderate
CVE-2026-61848 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Crass: A large number of adjacent CSS comments can trigger a SystemStackError Moderate
CVE-2026-61847 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage Moderate
CVE-2026-61846 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass Moderate
CVE-2026-116695 was published for crass (RubyGems) Oct 28, 2026
Pig-Tail Credited to Pig-Tail and rgrove rgrove rgrove
Crass : Large numeric exponents cause CPU and memory denial of service High
CVE-2026-61845 was published for crass (RubyGems) Oct 20, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Mechanize sends credential headers to another origin after a meta refresh Moderate
CVE-2026-107399 was published for mechanize (RubyGems) Oct 8, 2026
flavorjones Credited to flavorjones
Mechanize sends credential headers to another host after an HTTP redirect Moderate
CVE-2026-107715 was published for mechanize (RubyGems) Oct 8, 2026
SnailSploit Credited to SnailSploit
sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array Moderate
GHSA-mwm8-39rw-8826 was published for sqlite3 (RubyGems) Oct 2, 2026
jeremy Credited to jeremy
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) Critical
CVE-2026-77602 was published for openc3 (RubyGems) Sep 23, 2026
Marnick39 Credited to Marnick39
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting High
CVE-2026-77601 was published for openc3 (RubyGems) Sep 23, 2026
Marnick39 Credited to Marnick39
Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR) High
CVE-2026-94462 was published for spree_api (RubyGems) Sep 22, 2026
laijunyue Credited to laijunyue
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers Moderate
CVE-2026-65829 was published for MPXJ.Net (RubyGems) Sep 22, 2026
czTangt Credited to czTangt
MPXJ: XXE Vulnerability in MerlinReader High
CVE-2026-61570 was published for MPXJ.Net (RubyGems) Sep 22, 2026
dyingman1 Credited to dyingman1
decidim-elections: Election question titles allow stored script execution Moderate
CVE-2026-44282 was published for decidim-elections (RubyGems) Sep 9, 2026
rubyzip path traversal vulnerability High
CVE-2026-85396 was published for rubyzip (RubyGems) Sep 3, 2026
iBotPeaches Credited to iBotPeaches and jamgregory jamgregory jamgregory
Mail: Email address spoofing via malformed RFC 2047 encoded-words Moderate
CVE-2026-63435 was published for mail (RubyGems) Sep 2, 2026
mantas Credited to mantas and glefait glefait glefait
Duplicate Advisory: Nokogiri does not check the return value from xmlC14NExecute Moderate
GHSA-xqqh-3w52-q8p7 was published for nokogiri (RubyGems) Aug 25, 2026 • withdrawn
Duplicate Advisory: Nokogiri XSLT transform has a memory leak Moderate
GHSA-rh9x-7xjc-vwx2 was published for nokogiri (RubyGems) Aug 25, 2026 • withdrawn
Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking High
GHSA-5jhf-fpp7-v2pv was published for nokogiri (RubyGems) Aug 25, 2026 • withdrawn
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) Critical
CVE-2026-55107 was published for kobako (RubyGems) Aug 18, 2026
alhafoudh Credited to alhafoudh and ranjiGT ranjiGT ranjiGT
Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams Low
CVE-2026-71847 was published for json (RubyGems) Aug 7, 2026
guard-livereload has a directory traversal vulnerability Moderate
CVE-2016-1000305 was published for guard-livereload (RubyGems) Jul 31, 2026
Savon::Model evaluates WSDL operation names as Ruby source High
CVE-2026-53510 was published for savon (RubyGems) Jul 31, 2026
connorshea Credited to connorshea
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing Critical
CVE-2026-66066 was published for activestorage (RubyGems) Jul 30, 2026
0xacb Credited to 0xacb, Ry0taK, flavorjones, jeremy, byroot, ethiack-admin, s3np41k1r1t0, castilho101, and rafaelfranca Ry0taK Ry0taK
flavorjones flavorjones jeremy jeremy byroot byroot ethiack-admin ethiack-admin s3np41k1r1t0 s3np41k1r1t0 castilho101 castilho101 rafaelfranca rafaelfranca
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database