Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

16,222 advisories

Loading
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection Moderate
CVE-2026-119284 was published for joserfc (pip) Oct 30, 2026
ze3tar Credited to ze3tar
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users Moderate
GHSA-f3fj-9625-rv3m was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories Moderate
GHSA-fgxm-5hvv-x4vh was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99 and Xiaoyiyi23 Xiaoyiyi23 Xiaoyiyi23
zip: AES Entry HMAC Authentication Bypass on Premature EOF Moderate
CVE-2026-115906 was published for zip (Rust) Oct 29, 2026
secstant-sigp Credited to secstant-sigp and Its-Just-Nans Its-Just-Nans Its-Just-Nans
Vite: `server.fs.deny` bypassed with queries Moderate
CVE-2026-118662 was published for vite (npm) Oct 29, 2026
Hama1cco Credited to Hama1cco
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing Moderate
CVE-2026-9083 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak allows unauthorized access to resources via uma permission ticket bypass Moderate
CVE-2026-9799 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak: Attacker can re-enable and take over disabled clients via registration access token Moderate
CVE-2026-9705 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Crass: Non-ASCII characters cause superlinear CPU consumption Moderate
CVE-2026-61848 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Crass: A large number of adjacent CSS comments can trigger a SystemStackError Moderate
CVE-2026-61847 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage Moderate
CVE-2026-61846 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow Moderate
CVE-2026-55186 was published for silverstripe/mfa (Composer) Oct 29, 2026
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Moderate
CVE-2026-115927 was published for tornado (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Moderate
CVE-2026-116577 was published for tornado (pip) Oct 28, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass Moderate
CVE-2026-116695 was published for crass (RubyGems) Oct 28, 2026
Pig-Tail Credited to Pig-Tail and rgrove rgrove rgrove
Backstage catalog rules can be bypassed for URL locations using encoded path segments Moderate
CVE-2026-115923 was published for @backstage/plugin-catalog-backend (npm) Oct 28, 2026
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion Moderate
GHSA-2hw4-c9m4-f2fj was published for knative.dev/pkg (Go) Oct 28, 2026
tonghuaroot Credited to tonghuaroot
Waline login accepts a non-string email as a match-all MongoDB query Moderate
GHSA-jf75-q64q-g65r was published for @waline/vercel (npm) Oct 28, 2026
dizconnectz Credited to dizconnectz
Seroval: Code injection through a typed array's own constructor property Moderate
CVE-2026-116583 was published for seroval (npm) Oct 28, 2026
Seroval: Script injection through RegExp sources in serialized output Moderate
CVE-2026-116582 was published for seroval (npm) Oct 28, 2026
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) Moderate
CVE-2026-116575 was published for mem0ai (npm) Oct 28, 2026
OfficialAbhinavSingh Credited to OfficialAbhinavSingh
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim Moderate
CVE-2026-115910 was published for social-auth-core (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane and nijel nijel nijel
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank Moderate
CVE-2026-115920 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs Moderate
CVE-2026-115922 was published for onnx (pip) Oct 28, 2026
Zwique Credited to Zwique
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute Moderate
CVE-2026-115921 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database