Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

3,191 advisories

Loading
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service High
CVE-2026-118772 was published for @hapi/joi (npm) Oct 30, 2026
manus-use Credited to manus-use
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service High
CVE-2026-119202 was published for @hapi/content (npm) Oct 30, 2026
secalert Credited to secalert
Forge: Regular expression denial of service in PEM decoding (pem.decode) High
CVE-2026-118779 was published for node-forge (npm) Oct 30, 2026
AhmedMokhtari Credited to AhmedMokhtari, mwlik, imenyoo2, bibu123456, Kayiz-PT, and Mucahic mwlik mwlik
imenyoo2 imenyoo2 bibu123456 bibu123456 Kayiz-PT Kayiz-PT Mucahic Mucahic
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count High
CVE-2026-118782 was published for node-forge (npm) Oct 30, 2026
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message High
CVE-2026-119188 was published for node-forge (npm) Oct 30, 2026
Forge: Denial of service in TLS record processing via call stack exhaustion High
CVE-2026-119187 was published for node-forge (npm) Oct 30, 2026
Zyy0530 Credited to Zyy0530, 7thParkk, and Str1ckl4nd 7thParkk 7thParkk
Str1ckl4nd Str1ckl4nd
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 High
CVE-2026-119190 was published for node-forge (npm) Oct 30, 2026
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location High
CVE-2026-118763 was published for @sigstore/oci (npm) Oct 30, 2026
arpitjain099 Credited to arpitjain099
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects High
CVE-2026-116689 was published for follow-redirects (npm) Oct 30, 2026
burythevalley Credited to burythevalley
SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed High
CVE-2026-54606 was published for suneditor (npm) Aug 26, 2026
Adyej999 Credited to Adyej999 and brianandle brianandle brianandle
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service High
CVE-2026-115887 was published for graphql-scalars (npm) Oct 28, 2026
pozylon Credited to pozylon, dotansimha, enisdenjo, Pteam-sa, and otavlna dotansimha dotansimha
enisdenjo enisdenjo Pteam-sa Pteam-sa otavlna otavlna
@rog0x/mcp-docker-tools: executes arbitrary code via the handleImageList function High
CVE-2026-106765 was published for @rog0x/mcp-docker-tools (npm) Oct 23, 2026
stillmarcus24 Credited to stillmarcus24
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options High
CVE-2026-119282 was published for @nx/gradle (npm) Oct 30, 2026
arkmarta Credited to arkmarta
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function High
CVE-2026-106764 was published for @rog0x/mcp-git-tools (npm) Oct 23, 2026
stillmarcus24 Credited to stillmarcus24
@justice8096/sagemath-mcp-server: executes arbitrary code via the escapeShellString and sanitizeCode functions High
CVE-2026-106763 was published for @justice8096/sagemath-mcp-server (npm) Oct 23, 2026
stillmarcus24 Credited to stillmarcus24
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern High
CVE-2026-33287 was published for liquidjs (npm) Mar 25, 2026
koDove Credited to koDove, mikeflame, and SiteQ8 mikeflame mikeflame
SiteQ8 SiteQ8
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs High
CVE-2026-118664 was published for decode-uri-component (npm) Oct 29, 2026
gdegrange Credited to gdegrange
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy High
GHSA-w9x9-j56r-h98r was published for @eeacms/volto-chatbot (npm) Oct 29, 2026
EQSTLab Credited to EQSTLab
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY High
CVE-2026-62264 was published for @sylphx/pdf-reader-mcp (npm) Oct 29, 2026
novice-22 Credited to novice-22
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks High
CVE-2026-116576 was published for systeminformation (npm) Oct 28, 2026
itsFM-Codes Credited to itsFM-Codes
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) High
CVE-2026-116581 was published for seroval (npm) Oct 28, 2026
realies Credited to realies
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length High
CVE-2026-116584 was published for seroval (npm) Oct 28, 2026
llegomark Credited to llegomark
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check High
CVE-2026-116580 was published for seroval (npm) Oct 28, 2026
cruzryan Credited to cruzryan
Withdrawn Advisory: http-cache-semantics max-stale handling can disclose cross-user cached responses High
CVE-2026-93748 was published for http-cache-semantics (npm) Sep 18, 2026 • withdrawn
mazze93 Credited to mazze93
RE2JS: Quadratic-time denial of service in re2js lookbehind matching High
CVE-2026-116795 was published for re2js (npm) Oct 28, 2026
Nois3 Credited to Nois3
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database