Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,584
Rust
21

13,643 advisories

Loading
podman kube play symlink traversal vulnerability High
CVE-2025-9566 was published for github.com/containers/podman/v4 (Go) Sep 4, 2025
Luap99 Credited to Luap99
Apache Airflow: Authenticated users can bypass the `is_safe_url` check High
CVE-2026-40961 was published for apache-airflow (pip) Jun 1, 2026
maheshwarivijaykumar Credited to maheshwarivijaykumar
Composer has a command injection via malicious perforce repository High
CVE-2026-40176 was published for composer/composer (Composer) Apr 14, 2026
glaubinix Credited to glaubinix, Saku0512, and ranjiGT Saku0512 Saku0512
ranjiGT ranjiGT
FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export High
CVE-2026-45263 was published for facturascripts/facturascripts (Composer) Jul 14, 2026
zuhairhalawa Credited to zuhairhalawa
Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion High
CVE-2026-47736 was published for puma (RubyGems) Jun 8, 2026
Pirikara Credited to Pirikara and ranjiGT ranjiGT ranjiGT
Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections High
CVE-2026-47737 was published for puma (RubyGems) Jun 9, 2026
vxhex Credited to vxhex, nateberkopec, and ranjiGT nateberkopec nateberkopec
ranjiGT ranjiGT
NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots High
CVE-2026-81726 was published for nltk (pip) Sep 2, 2026
itzik123 Credited to itzik123 and otovar-vc otovar-vc otovar-vc
websocket-driver-ruby: Denial of service via malformed Host header High
CVE-2026-61666 was published for websocket-driver (RubyGems) Jul 21, 2026
pranjalithakur Credited to pranjalithakur
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import High
CVE-2026-59176 was published for functype-mcp-server (npm) Sep 9, 2026
EQSTLab Credited to EQSTLab and ranjiGT ranjiGT ranjiGT
obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete High
GHSA-62gx-5q78-wrvx was published for obsidian-local-rest-api (npm) Jul 15, 2026
AgenticWizard Credited to AgenticWizard and zuhairhalawa zuhairhalawa zuhairhalawa
Incorrect version tags linked to external repository High
GHSA-593v-wcqx-hq2w was published for parse-server (npm) Sep 7, 2021
SD JWT JS: Tampered disclosures silently dropped instead of rejected High
CVE-2026-62374 was published for @sd-jwt/core (npm) Nov 2, 2026
tyche-dev Credited to tyche-dev
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__ High
GHSA-v853-p72q-4cfw was published for quart (pip) Oct 5, 2026
Kennarttechl Credited to Kennarttechl
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) High
CVE-2026-102827 was published for simple-git (npm) Oct 5, 2026
anir0y Credited to anir0y, bilguunbicktivism, cruzryan, the-vibe-dev, D7EAD, dellalibera, gdegrange, CFionaBF, b1ue0ceanRun, Leeziao, internetteletubbie, and arundr0id bilguunbicktivism bilguunbicktivism
cruzryan cruzryan the-vibe-dev the-vibe-dev D7EAD D7EAD dellalibera dellalibera gdegrange gdegrange CFionaBF CFionaBF b1ue0ceanRun b1ue0ceanRun Leeziao Leeziao internetteletubbie internetteletubbie arundr0id arundr0id
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory High
CVE-2026-118761 was published for github.com/kubeflow/pipelines (Go) Oct 30, 2026
bugbunny-research Credited to bugbunny-research
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs High
CVE-2026-118759 was published for github.com/kubeflow/pipelines (Go) Oct 30, 2026
bugbunny-research Credited to bugbunny-research
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search High
CVE-2026-119203 was published for pypdf (pip) Oct 30, 2026
smaeljaish771 Credited to smaeljaish771
pypdf has possible large memory usage when parsing page tree High
CVE-2026-119204 was published for pypdf (pip) Oct 30, 2026
smaeljaish771 Credited to smaeljaish771
pypdf has possible infinite loop when cloning dictionaries High
CVE-2026-119205 was published for pypdf (pip) Oct 30, 2026
smaeljaish771 Credited to smaeljaish771 and KeenSecurityLab KeenSecurityLab KeenSecurityLab
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service High
CVE-2026-118772 was published for @hapi/joi (npm) Oct 30, 2026
manus-use Credited to manus-use
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service High
CVE-2026-119202 was published for @hapi/content (npm) Oct 30, 2026
secalert Credited to secalert
Authlib RFC 7592 examples omit registration-access-token client binding High
CVE-2026-116672 was published for Authlib (pip) Oct 30, 2026
alham-rizvi Credited to alham-rizvi
pypdf has possible long runtimes when retrieving page labels High
CVE-2026-119206 was published for pypdf (pip) Oct 30, 2026
rozzkml Credited to rozzkml and kholdrex kholdrex kholdrex
pypdf has possible large memory usage for exceptions in strict mode High
CVE-2026-119207 was published for pypdf (pip) Oct 30, 2026
pypdf has possible long runtimes/large memory usage for encrypted PDF files High
CVE-2026-119208 was published for pypdf (pip) Oct 30, 2026
DharmendraSoni5110 Credited to DharmendraSoni5110
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database