Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

16,245 advisories

Loading
minimatch has potential denial of service via globparts amplification Moderate
CVE-2026-118764 was published for minimatch (npm) Oct 30, 2026
b1nv0id Credited to b1nv0id
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal Moderate
CVE-2026-118773 was published for glob (npm) Oct 30, 2026
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie Moderate
CVE-2026-118777 was published for node-forge (npm) Oct 30, 2026
arunmozhivarman-dtx Credited to arunmozhivarman-dtx and Dremig Dremig Dremig
Forge: TLS client crash when the server sends no certificate Moderate
CVE-2026-118778 was published for node-forge (npm) Oct 30, 2026
arpitjain099 Credited to arpitjain099
Forge: AES-GCM authentication bypass via unvalidated tagLength option Moderate
CVE-2026-119186 was published for node-forge (npm) Oct 30, 2026
PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling Moderate
CVE-2026-119193 was published for phpunit/phpunit (Composer) Oct 30, 2026
edorian Credited to edorian and patschmittdev patschmittdev patschmittdev
Nuxt dev server exposes generated appSecret through Vite file serving Moderate
CVE-2026-119201 was published for @nuxt/vite-builder (npm) Oct 30, 2026
Duodum Credited to Duodum
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes Moderate
CVE-2026-119200 was published for @nuxt/nitro-server (npm) Oct 30, 2026
vinzabe Credited to vinzabe, nikhilagrawalsf, 0xjunwei, and kq5y nikhilagrawalsf nikhilagrawalsf
0xjunwei 0xjunwei kq5y kq5y
Nuxt dev server arbitrary file read through client error reports Moderate
CVE-2026-119198 was published for @nuxt/vite-builder (npm) Oct 30, 2026
samsulselfut Credited to samsulselfut
Nuxt dev server exposes private runtime config through the Nitro dev bundle Moderate
CVE-2026-119199 was published for @nuxt/vite-builder (npm) Oct 30, 2026
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets Moderate
CVE-2026-119276 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths Moderate
CVE-2026-119279 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files Moderate
CVE-2026-119210 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
buxu Credited to buxu
MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing Moderate
CVE-2026-119281 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) Moderate
CVE-2026-116774 was published for russh (Rust) Oct 30, 2026
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets Moderate
CVE-2026-116773 was published for russh (Rust) Oct 30, 2026
Hama1cco Credited to Hama1cco
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations Moderate
CVE-2026-116677 was published for openwisp-controller (pip) Oct 30, 2026
KasperBuilds Credited to KasperBuilds
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads Moderate
CVE-2026-119285 was published for github.com/gofiber/fiber/v2 (Go) Oct 30, 2026
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher Moderate
GHSA-7wpf-ch8f-5f4x was published for signalk-server (npm) Oct 30, 2026
zachariah-mithani Credited to zachariah-mithani
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS Moderate
GHSA-2wrx-84qj-4pcg was published for github.com/anacrolix/torrent (Go) Oct 30, 2026
Reload3d Credited to Reload3d
AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE Moderate
CVE-2026-96634 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
zdi-disclosures Credited to zdi-disclosures and vrana vrana vrana
AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery Moderate
CVE-2026-96629 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
az0mb13 Credited to az0mb13 and vrana vrana vrana
NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 Moderate
CVE-2026-54442 was published for gov.nsa.emissary:emissary (Maven) Oct 30, 2026
decsecre583 Credited to decsecre583
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection Moderate
CVE-2026-119284 was published for joserfc (pip) Oct 30, 2026
ze3tar Credited to ze3tar
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users Moderate
GHSA-f3fj-9625-rv3m was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database