Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

200 advisories

Loading
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) Low
CVE-2026-116775 was published for pageant (Rust) Oct 30, 2026
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages Low
CVE-2026-116696 was published for russh (Rust) Oct 30, 2026
Hama1cco Credited to Hama1cco
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence Low
GHSA-c33x-vcv4-vg3g was published for @cedar-policy/cedar-wasm (npm) Oct 29, 2026
john-h-kastner-aws Credited to john-h-kastner-aws and DenizParlak DenizParlak DenizParlak
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert Low
GHSA-vp88-798v-h67f was published for rustls (Rust) Oct 27, 2026
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share Low
GHSA-w44r-93j7-qv28 was published for rustls (Rust) Oct 27, 2026
Adam010341 Credited to Adam010341
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. Low
GHSA-h2v8-394m-p7vv was published for rustls (Rust) Oct 27, 2026
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root Low
GHSA-h4fr-cmh5-qr62 was published for @fallow-cli/fallow-node (npm) Oct 23, 2026
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root Low
CVE-2026-115569 was published for @fallow-cli/fallow-node (npm) Oct 23, 2026
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request Low
CVE-2026-111062 was published for russh (Rust) Oct 19, 2026
Eric-D Credited to Eric-D
cut: -s ignored in -z -d '' newline-delimiter mode Low
CVE-2026-35381 was published for uu_cut (Rust) Jul 6, 2026
vitoroliveirasilva Credited to vitoroliveirasilva
Wasmtime: Preemption and traps during bulk operations enable breaking internal VM state Low
CVE-2026-104855 was published for wasmtime (Rust) Oct 2, 2026
xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release Low
GHSA-6g2r-675j-hx59 was published for xxhash-rust (Rust) Oct 2, 2026
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic Low
CVE-2026-102822 was published for russh (Rust) Sep 30, 2026
sonicnew Credited to sonicnew
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path Low
CVE-2026-102825 was published for russh (Rust) Sep 30, 2026
arpitjain099 Credited to arpitjain099
SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type Low
CVE-2024-58356 was published for surrealdb (Rust) Dec 16, 2024
AlbertMarashi Credited to AlbertMarashi
Duplicate Advisory: SurrealDB has Silent Failure to Overwrite Table Definition of Relation Type Low
GHSA-vmg6-53r4-jhpw was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
Duplicate Advisory: SurrealDB no JavaScript script function default timeout could facilitate DoS Low
GHSA-6g9r-xqrf-34xh was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
Wasmtime has a leak in WASIp1 `fd_renumber` implementation Low
CVE-2026-54786 was published for wasmtime-wasi (Rust) Aug 26, 2026
alexcrichton Credited to alexcrichton
Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics Low
GHSA-2625-rw7m-5q5x was published for hubuum_client (Rust) Jul 24, 2026
nimiq-primitives: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof Low
CVE-2026-54542 was published for nimiq-primitives (Rust) Jul 16, 2026
paberr Credited to paberr and Piravlos Piravlos Piravlos
nimiq-primitives: Panic in TrieProof::verify via child_index unwrap on equal-length keys Low
CVE-2026-54541 was published for nimiq-primitives (Rust) Jul 16, 2026
paberr Credited to paberr and Piravlos Piravlos Piravlos
Wasmtime: Memory leak in C API with `externref` and `anyref` types Low
CVE-2025-61670 was published for wasmtime-bin (pip) Jul 14, 2026
alexcrichton Credited to alexcrichton
rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path Low
GHSA-cwv4-h3j5-w3cf was published for rama (Rust) Jul 7, 2026
chaitanyagarware Credited to chaitanyagarware
Duplicate Advisory: uutils coreutils has an Incorrect Provision of Specified Functionality Issue in its cut Utility Low
GHSA-532v-xp3f-837c was published for coreutils (Rust) Apr 22, 2026 • withdrawn
mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node) Low
CVE-2026-35361 was published for uu_mknod (Rust) Jul 6, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database