Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

631 advisories

Loading
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) Moderate
CVE-2026-116774 was published for russh (Rust) Oct 30, 2026
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets Moderate
CVE-2026-116773 was published for russh (Rust) Oct 30, 2026
Hama1cco Credited to Hama1cco
block_buffer: panic corrupts inline buffer position Moderate
GHSA-qwgh-2vcv-g2f7 was published for block_buffer (Rust) Aug 19, 2026
fwhskr Credited to fwhskr, Gerharddc, thomasqueirozb, rldyourmnd, aodl, and mcf-capx Gerharddc Gerharddc
thomasqueirozb thomasqueirozb rldyourmnd rldyourmnd aodl aodl mcf-capx mcf-capx
uv has ZIP payload obfuscation through parsing differentials Moderate
CVE-2025-13327 was published for uv (Rust) Feb 27, 2026
zip: AES Entry HMAC Authentication Bypass on Premature EOF Moderate
CVE-2026-115906 was published for zip (Rust) Oct 29, 2026
secstant-sigp Credited to secstant-sigp and Its-Just-Nans Its-Just-Nans Its-Just-Nans
Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs Moderate
GHSA-c8m5-c952-6cm4 was published for rustls (Rust) Oct 27, 2026
Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries Moderate
GHSA-2mjx-qc3c-rqvc was published for rustls (Rust) Oct 5, 2026
randombit Credited to randombit and ranjiGT ranjiGT ranjiGT
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type Moderate
CVE-2026-115892 was published for wasmtime (Rust) Oct 23, 2026
Tokio: Race condition in `tokio::time::Interval` Moderate
CVE-2026-115567 was published for tokio (Rust) Oct 23, 2026
ByteZ1337 Credited to ByteZ1337 and carabistouflette carabistouflette carabistouflette
ammonia: mXSS via MathML `annotation-xml` encoding strip Moderate
CVE-2026-63430 was published for ammonia (Rust) Oct 22, 2026
Ivan09999 Credited to Ivan09999
Slack Morphism verifier errors disclose valid HMACs in the logs Moderate
CVE-2026-113799 was published for slack-morphism (Rust) Oct 21, 2026
Ridful Credited to Ridful
russh: Unbounded memory allocation in agent protocol server via crafted constraint records Moderate
CVE-2026-111061 was published for russh (Rust) Oct 19, 2026
Tan-JunWei Credited to Tan-JunWei
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination Moderate
CVE-2026-58494 was published for wasmtime-wasi (Rust) Oct 16, 2026
sdjasj Credited to sdjasj
uv: Path traversal on Windows through wheel extraction Moderate
CVE-2026-104843 was published for uv (pip) Oct 5, 2026
woodruffw Credited to woodruffw, charliermarsh, and White0xdi3 charliermarsh charliermarsh
White0xdi3 White0xdi3
hickory-resolver follows irrelevant CNAME records Moderate
GHSA-6f2x-v7q7-m7m5 was published for hickory-resolver (Rust) Oct 5, 2026
qifan-sailboat Credited to qifan-sailboat
rmcp OAuth client fetches server-controlled resource_metadata URLs Moderate
GHSA-c9xm-49cp-xcr9 was published for rmcp (Rust) Oct 2, 2026
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows) Moderate
CVE-2026-102820 was published for pageant (Rust) Sep 30, 2026
Guigu98 Credited to Guigu98
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey Moderate
CVE-2026-102821 was published for russh (Rust) Sep 30, 2026
Guigu98 Credited to Guigu98
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange Moderate
CVE-2026-102824 was published for russh (Rust) Sep 30, 2026
arpitjain099 Credited to arpitjain099
Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Moderate
CVE-2026-102342 was published for ammonia (Rust) Sep 29, 2026
koyokr Credited to koyokr
yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB Moderate
GHSA-2jx3-ff3v-j7jj was published for yara-x (Rust) Sep 24, 2026
Manishearth Credited to Manishearth
microsandbox: Secret values exposed in world-readable process arguments Moderate
CVE-2026-61670 was published for microsandbox (Rust) Sep 22, 2026
nopcorn Credited to nopcorn
RMCP: Custom HTTP headers leak to cross-origin redirect targets Moderate
CVE-2026-64684 was published for rmcp (Rust) Sep 17, 2026
gix-sec safe.directory protections absent for elevated administrators Moderate
CVE-2025-24890 was published for gix-sec (Rust) Sep 9, 2026
EliahKagan Credited to EliahKagan
SWC HTML minifier may allow script element breakout when minifying embedded JSON Moderate
CVE-2026-72925 was published for @swc/html (npm) Sep 8, 2026
j9t Credited to j9t
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database