Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,581
Rust
21

2,887 advisories

Loading
minimatch has potential denial of service via globparts amplification Moderate
CVE-2026-118764 was published for minimatch (npm) Oct 30, 2026
b1nv0id Credited to b1nv0id
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal Moderate
CVE-2026-118773 was published for glob (npm) Oct 30, 2026
Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie Moderate
CVE-2026-118777 was published for node-forge (npm) Oct 30, 2026
arunmozhivarman-dtx Credited to arunmozhivarman-dtx and Dremig Dremig Dremig
Forge: TLS client crash when the server sends no certificate Moderate
CVE-2026-118778 was published for node-forge (npm) Oct 30, 2026
arpitjain099 Credited to arpitjain099
Forge: AES-GCM authentication bypass via unvalidated tagLength option Moderate
CVE-2026-119186 was published for node-forge (npm) Oct 30, 2026
Nuxt dev server exposes generated appSecret through Vite file serving Moderate
CVE-2026-119201 was published for @nuxt/vite-builder (npm) Oct 30, 2026
Duodum Credited to Duodum
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes Moderate
CVE-2026-119200 was published for @nuxt/nitro-server (npm) Oct 30, 2026
vinzabe Credited to vinzabe, nikhilagrawalsf, 0xjunwei, and kq5y nikhilagrawalsf nikhilagrawalsf
0xjunwei 0xjunwei kq5y kq5y
Nuxt dev server arbitrary file read through client error reports Moderate
CVE-2026-119198 was published for @nuxt/vite-builder (npm) Oct 30, 2026
samsulselfut Credited to samsulselfut
Nuxt dev server exposes private runtime config through the Nitro dev bundle Moderate
CVE-2026-119199 was published for @nuxt/vite-builder (npm) Oct 30, 2026
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher Moderate
GHSA-7wpf-ch8f-5f4x was published for signalk-server (npm) Oct 30, 2026
zachariah-mithani Credited to zachariah-mithani
Vite: `server.fs.deny` bypassed with queries Moderate
CVE-2026-118662 was published for vite (npm) Oct 29, 2026
Hama1cco Credited to Hama1cco
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) Moderate
CVE-2026-110816 was published for qs (npm) Oct 27, 2026
manus-pi Credited to manus-pi, Lucidsec, manus-use, and KeenSecurityLab Lucidsec Lucidsec
manus-use manus-use KeenSecurityLab KeenSecurityLab
Backstage catalog rules can be bypassed for URL locations using encoded path segments Moderate
CVE-2026-115923 was published for @backstage/plugin-catalog-backend (npm) Oct 28, 2026
Waline login accepts a non-string email as a match-all MongoDB query Moderate
GHSA-jf75-q64q-g65r was published for @waline/vercel (npm) Oct 28, 2026
dizconnectz Credited to dizconnectz
Seroval: Code injection through a typed array's own constructor property Moderate
CVE-2026-116583 was published for seroval (npm) Oct 28, 2026
Seroval: Script injection through RegExp sources in serialized output Moderate
CVE-2026-116582 was published for seroval (npm) Oct 28, 2026
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) Moderate
CVE-2026-116575 was published for mem0ai (npm) Oct 28, 2026
OfficialAbhinavSingh Credited to OfficialAbhinavSingh
systeminformation has prototype pollution in `networkStats()` via the interface name Moderate
CVE-2026-116674 was published for systeminformation (npm) Oct 28, 2026
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies Moderate
CVE-2026-118661 was published for happy-dom (npm) Oct 28, 2026
cruzryan Credited to cruzryan
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller Moderate
CVE-2026-118666 was published for @graphql-tools/executor-legacy-ws (npm) Oct 28, 2026
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths Moderate
CVE-2026-118663 was published for @hono/node-server (npm) Oct 28, 2026
manop55555 Credited to manop55555
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. Moderate
CVE-2026-118247 was published for @highcharts/dashboards (npm) Oct 28, 2026
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` Moderate
CVE-2026-118243 was published for @highcharts/dashboards (npm) Oct 28, 2026
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering Moderate
CVE-2026-109932 was published for undici (npm) Oct 27, 2026
benzdeus Credited to benzdeus, UlisesGascon, and mcollina UlisesGascon UlisesGascon
mcollina mcollina
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor Moderate
CVE-2026-87029 was published for undici (npm) Oct 27, 2026
Yanhaoxi Credited to Yanhaoxi, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database