Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

3,440 advisories

Loading
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets Moderate
CVE-2026-119276 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths Moderate
CVE-2026-119279 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files Moderate
CVE-2026-119210 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
buxu Credited to buxu
MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing Moderate
CVE-2026-119281 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 Moderate
CVE-2026-54442 was published for gov.nsa.emissary:emissary (Maven) Oct 30, 2026
decsecre583 Credited to decsecre583
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing Moderate
CVE-2026-9083 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak allows unauthorized access to resources via uma permission ticket bypass Moderate
CVE-2026-9799 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak: Attacker can re-enable and take over disabled clients via registration access token Moderate
CVE-2026-9705 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing Moderate
CVE-2026-118259 was published for io.opentelemetry:opentelemetry-api (Maven) Oct 28, 2026
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite Moderate
CVE-2026-116590 was published for org.xerial.snappy:snappy-java (Maven) Oct 27, 2026
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies Moderate
CVE-2026-113730 was published for ognl:ognl (Maven) Oct 21, 2026
garymao Credited to garymao
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure Moderate
CVE-2026-111762 was published for org.a2aproject.sdk:a2a-java-sdk-transport-rest (Maven) Oct 20, 2026
ehsavoie Credited to ehsavoie
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery Moderate
CVE-2026-111761 was published for org.a2aproject.sdk:a2a-java-sdk-server-common (Maven) Oct 20, 2026
asishinfosec Credited to asishinfosec
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect Moderate
CVE-2026-111763 was published for org.a2aproject.sdk:a2a-java-sdk-parent (Maven) Oct 20, 2026
ehsavoie Credited to ehsavoie
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) Moderate
CVE-2026-107228 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
1diot9 Credited to 1diot9
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS Moderate
CVE-2026-107226 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel Moderate
CVE-2026-107285 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk Moderate
CVE-2026-107280 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS Moderate
CVE-2026-106121 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
NotAFlightRisk Credited to NotAFlightRisk
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs Moderate
CVE-2026-106450 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers Moderate
CVE-2026-106122 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
ba-am Credited to ba-am
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() Moderate
CVE-2026-106123 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
sonicnew Credited to sonicnew, mark-adams, HonorableSudoku, and xnuinside mark-adams mark-adams
HonorableSudoku HonorableSudoku xnuinside xnuinside
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header Moderate
CVE-2026-106452 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat Credited to yawkat
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError Moderate
CVE-2026-106453 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Snowflake drivers writes sensitive information to logs Moderate
CVE-2026-86597 was published for github.com/snowflakedb/gosnowflake (Go) Oct 5, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database