Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,620
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

6,794 advisories

Loading
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection Moderate
CVE-2026-119284 was published for joserfc (pip) Oct 30, 2026
ze3tar Credited to ze3tar
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption High
CVE-2026-119283 was published for joserfc (pip) Oct 30, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset High
GHSA-vpp8-g58w-m8mp was published for Twisted (pip) Oct 29, 2026
arkmarta Credited to arkmarta
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox High
CVE-2026-61438 was published for praisonai (pip) Oct 29, 2026
chakrapani150 Credited to chakrapani150
Duplicate Advisory: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox High
GHSA-qh3g-555w-f82q was published for PraisonAI (pip) Jul 15, 2026 • withdrawn
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package Critical
CVE-2026-111497 was published for brotli (pip) Oct 22, 2026
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Moderate
CVE-2026-115927 was published for tornado (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane
Tornado: Open redirect in RedirectHandler via protocol-relative URLs Low
CVE-2026-116578 was published for tornado (pip) Oct 28, 2026
gn00295120 Credited to gn00295120
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Moderate
CVE-2026-116577 was published for tornado (pip) Oct 28, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it Critical
CVE-2026-117601 was published for electrum (pip) Oct 28, 2026
Raju-K12 Credited to Raju-K12
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) Moderate
CVE-2026-116575 was published for mem0ai (npm) Oct 28, 2026
OfficialAbhinavSingh Credited to OfficialAbhinavSingh
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim Moderate
CVE-2026-115910 was published for social-auth-core (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane and nijel nijel nijel
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank Moderate
CVE-2026-115920 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs Moderate
CVE-2026-115922 was published for onnx (pip) Oct 28, 2026
Zwique Credited to Zwique
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute Moderate
CVE-2026-115921 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) Moderate
CVE-2026-115919 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server Low
CVE-2026-115917 was published for vllm (pip) Oct 28, 2026
prnjlksingh Credited to prnjlksingh and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine Moderate
CVE-2026-115913 was published for vllm (pip) Oct 28, 2026
C1ves Credited to C1ves and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM DeepSeek-OCR image processing vulnerable to denial of service Moderate
CVE-2026-115914 was published for vllm (pip) Oct 28, 2026
C1ves Credited to C1ves, jperezdealgaba, and JSGforever jperezdealgaba jperezdealgaba
JSGforever JSGforever
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE High
CVE-2026-115915 was published for vllm (pip) Oct 28, 2026
LittlehamsterXu Credited to LittlehamsterXu and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled High
CVE-2026-115912 was published for vllm (pip) Oct 28, 2026
KernelClint Credited to KernelClint, DarkLight1337, and jperezdealgaba DarkLight1337 DarkLight1337
jperezdealgaba jperezdealgaba
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) Moderate
CVE-2026-115916 was published for vllm (pip) Oct 28, 2026
shijie-lyu Credited to shijie-lyu and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs Moderate
CVE-2026-115918 was published for vllm (pip) Oct 28, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool Moderate
CVE-2026-115911 was published for vllm (pip) Oct 28, 2026
oran-s Credited to oran-s and jperezdealgaba jperezdealgaba jperezdealgaba
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output Moderate
CVE-2026-115885 was published for langgraph-cli (pip) Oct 28, 2026
C0KERNEL Credited to C0KERNEL
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database