Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

833 advisories

Loading
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it Critical
CVE-2026-117601 was published for electrum (pip) Oct 28, 2026
Raju-K12 Credited to Raju-K12
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules Critical
CVE-2026-116692 was published for mlflow (pip) Oct 27, 2026
mskca Credited to mskca
Authlib: empty signatures validation in JWS JSON deserialization Critical
CVE-2026-96760 was published for authlib (pip) Oct 27, 2026
zer0d4y5 Credited to zer0d4y5, uziii2208, and nguyenminhtuan28 uziii2208 uziii2208
nguyenminhtuan28 nguyenminhtuan28
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall` Critical
CVE-2026-35002 was published for agno (pip) Oct 27, 2026
harshsinha03 Credited to harshsinha03
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) Critical
CVE-2026-48705 was published for monai (pip) Oct 27, 2026
cldrn Credited to cldrn
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution Critical
CVE-2026-112398 was published for pillow (pip) Oct 23, 2026
pebwalker Credited to pebwalker
Pillow multi-frame loaders can reuse stale native image storage after mode transitions Critical
CVE-2026-96639 was published for Pillow (pip) Oct 22, 2026
rotemkama Credited to rotemkama
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package Critical
CVE-2026-111497 was published for brotli (pip) Oct 22, 2026
mem0ai Databricks vector store vulnerable to SQL injection Critical
CVE-2026-115324 was published for mem0ai (pip) Oct 22, 2026
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Critical
CVE-2026-112393 was published for Pillow (pip) Oct 21, 2026
carlini Credited to carlini and Tomer-PL Tomer-PL Tomer-PL
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Critical
CVE-2026-112900 was published for Pillow (pip) Oct 21, 2026
HLe4s-kaist Credited to HLe4s-kaist, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution Critical
GHSA-f623-hjm8-5wg5 was published for vllm (pip) Oct 21, 2026 • withdrawn
Pillow: Heap buffer overflow in ImagingJpegDecode Critical
CVE-2026-112403 was published for Pillow (pip) Oct 20, 2026
DavidKorczynski Credited to DavidKorczynski
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised Critical
GHSA-hq85-5cpj-mr62 was published for uv (pip) Oct 20, 2026
woodruffw Credited to woodruffw
certifi bundles emSign root CAs with compromised intermediate CA keys Critical
GHSA-6q48-6c7w-9gw2 was published for certifi (pip) Oct 20, 2026
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass Critical
CVE-2026-111057 was published for mercury (pip) Oct 19, 2026
szotgan Credited to szotgan
Mercury: Unauthenticated Remote Code Execution via /api/kernels Critical
CVE-2026-111058 was published for mercury (pip) Oct 19, 2026
CyberKareem Credited to CyberKareem
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport Critical
CVE-2026-105192 was published for lmcache (pip) Oct 16, 2026
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls Critical
CVE-2026-61445 was published for praisonai (pip) Oct 8, 2026
anushkavirgaonkar Credited to anushkavirgaonkar
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets Critical
CVE-2026-61447 was published for praisonaiagents (pip) Oct 8, 2026
anushkavirgaonkar Credited to anushkavirgaonkar
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration Critical
CVE-2026-105697 was published for langflow (pip) Oct 7, 2026
MosesOX Credited to MosesOX, andifilhohub, and erichare andifilhohub andifilhohub
erichare erichare
PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation Critical
CVE-2026-62176 was published for PraisonAI (pip) Oct 7, 2026
anushkavirgaonkar Credited to anushkavirgaonkar
Duplicate Advisory: Remote code execution via unsafe deserialization in multiprocess mode transport Critical
GHSA-vv44-hjm2-qw2f was published for lmcache (pip) Oct 7, 2026 • withdrawn
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation Critical
CVE-2026-10561 was published for langflow (pip) Oct 6, 2026
XlabAITeam Credited to XlabAITeam, pkuGenuine, keenanwgn, andifilhohub, and erichare pkuGenuine pkuGenuine
keenanwgn keenanwgn andifilhohub andifilhohub erichare erichare
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database