Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,583
Rust
21

2,745 advisories

Loading
Forge: ASN.1 OID first arc truncation in asn1.oidToDer Low
CVE-2026-118775 was published for node-forge (npm) Oct 30, 2026
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) Low
CVE-2026-118781 was published for node-forge (npm) Oct 30, 2026
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store Low
CVE-2026-118780 was published for node-forge (npm) Oct 30, 2026
pravichandran15 Credited to pravichandran15
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths Low
CVE-2026-119280 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) Low
CVE-2026-116775 was published for pageant (Rust) Oct 30, 2026
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages Low
CVE-2026-116696 was published for russh (Rust) Oct 30, 2026
Hama1cco Credited to Hama1cco
FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation Low
CVE-2026-27964 was published for facturascripts/facturascripts (Composer) May 7, 2026
jaroslaw-wawiorko Credited to jaroslaw-wawiorko and zuhairhalawa zuhairhalawa zuhairhalawa
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence Low
GHSA-c33x-vcv4-vg3g was published for @cedar-policy/cedar-wasm (npm) Oct 29, 2026
john-h-kastner-aws Credited to john-h-kastner-aws and DenizParlak DenizParlak DenizParlak
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Low
CVE-2026-61448 was published for parse-server (npm) Oct 29, 2026
CyberKareem Credited to CyberKareem and mtrezza mtrezza mtrezza
Duplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Low
GHSA-p6c5-mjgj-m4rm was published for parse-server (npm) Jul 11, 2026 • withdrawn
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets Low
GHSA-pg53-p7qp-65cv was published for pocketmine/pocketmine-mp (Composer) Oct 29, 2026
Genesizs Credited to Genesizs and dktapps dktapps dktapps
i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) Low
CVE-2026-115730 was published for i18next-http-backend (npm) Oct 28, 2026
zachariah-mithani Credited to zachariah-mithani
Tornado: Open redirect in RedirectHandler via protocol-relative URLs Low
CVE-2026-116578 was published for tornado (pip) Oct 28, 2026
gn00295120 Credited to gn00295120
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server Low
CVE-2026-115917 was published for vllm (pip) Oct 28, 2026
prnjlksingh Credited to prnjlksingh and jperezdealgaba jperezdealgaba jperezdealgaba
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net Low
CVE-2026-116673 was published for systeminformation (npm) Oct 28, 2026
itsFM-Codes Credited to itsFM-Codes
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string Low
CVE-2026-118258 was published for i18next-http-backend (npm) Oct 28, 2026
adriank31 Credited to adriank31
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock Low
CVE-2026-112941 was published for filelock (pip) Oct 28, 2026
filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker Low
CVE-2026-112912 was published for filelock (pip) Oct 28, 2026
Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf) Low
GHSA-w47m-j727-m843 was published for i18next-http-backend (npm) Oct 23, 2026 • withdrawn
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list Low
CVE-2026-118256 was published for @intlify/core (npm) Oct 28, 2026
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through Low
CVE-2026-55458 was published for github.com/caddyserver/caddy/v2 (Go) Oct 28, 2026
jirn073-76 Credited to jirn073-76
OpenAM SAML2 Cluster Cookie-Hash-Redirect Path has Pre-authentication Reflected XSS via `FSUtils.postToTarget` Low
CVE-2026-44793 was published for org.openidentityplatform.openam:openam-federation-library (Maven) Jun 22, 2026
gujjuboy10x00 Credited to gujjuboy10x00 and zuhairhalawa zuhairhalawa zuhairhalawa
deepmerge mergeObject() allows prototype poisoning of returned objects Low
CVE-2026-93753 was published for deepmerge (npm) Sep 18, 2026
CKEditor: Cross-site scripting (XSS) in the engine package Low
CVE-2026-116687 was published for @ckeditor/ckeditor5-engine (npm) Oct 27, 2026
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert Low
GHSA-vp88-798v-h67f was published for rustls (Rust) Oct 27, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database