Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

2,703 advisories

Loading
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations Moderate
CVE-2026-116677 was published for openwisp-controller (pip) Oct 30, 2026
KasperBuilds Credited to KasperBuilds
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection Moderate
CVE-2026-119284 was published for joserfc (pip) Oct 30, 2026
ze3tar Credited to ze3tar
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Moderate
CVE-2026-115927 was published for tornado (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Moderate
CVE-2026-116577 was published for tornado (pip) Oct 28, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) Moderate
CVE-2026-116575 was published for mem0ai (npm) Oct 28, 2026
OfficialAbhinavSingh Credited to OfficialAbhinavSingh
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim Moderate
CVE-2026-115910 was published for social-auth-core (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane and nijel nijel nijel
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank Moderate
CVE-2026-115920 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs Moderate
CVE-2026-115922 was published for onnx (pip) Oct 28, 2026
Zwique Credited to Zwique
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute Moderate
CVE-2026-115921 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) Moderate
CVE-2026-115919 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine Moderate
CVE-2026-115913 was published for vllm (pip) Oct 28, 2026
C1ves Credited to C1ves and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM DeepSeek-OCR image processing vulnerable to denial of service Moderate
CVE-2026-115914 was published for vllm (pip) Oct 28, 2026
C1ves Credited to C1ves, jperezdealgaba, and JSGforever jperezdealgaba jperezdealgaba
JSGforever JSGforever
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) Moderate
CVE-2026-115916 was published for vllm (pip) Oct 28, 2026
shijie-lyu Credited to shijie-lyu and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs Moderate
CVE-2026-115918 was published for vllm (pip) Oct 28, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool Moderate
CVE-2026-115911 was published for vllm (pip) Oct 28, 2026
oran-s Credited to oran-s and jperezdealgaba jperezdealgaba jperezdealgaba
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output Moderate
CVE-2026-115885 was published for langgraph-cli (pip) Oct 28, 2026
C0KERNEL Credited to C0KERNEL
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) Moderate
CVE-2026-116579 was published for autobahn (pip) Oct 28, 2026
adriank31 Credited to adriank31
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold Moderate
CVE-2026-112908 was published for filelock (pip) Oct 28, 2026
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion Moderate
CVE-2026-112911 was published for filelock (pip) Oct 28, 2026
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL Moderate
CVE-2026-112910 was published for filelock (pip) Oct 28, 2026
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout Moderate
CVE-2026-112915 was published for filelock (pip) Oct 28, 2026
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker Moderate
CVE-2026-112939 was published for filelock (pip) Oct 28, 2026
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path Moderate
CVE-2026-112909 was published for filelock (pip) Oct 28, 2026
filelock: ReadWriteLock follows a symlink at the lock path into SQLite Moderate
CVE-2026-112936 was published for filelock (pip) Oct 28, 2026
Kwstubbs Credited to Kwstubbs
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses Moderate
CVE-2026-112938 was published for filelock (pip) Oct 28, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database