Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

37,249 advisories

Loading
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service Moderate
GHSA-4ffr-jq9g-5ffx was published for nodemailer (npm) Oct 27, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped Moderate
GHSA-g73g-hqqh-jr95 was published for nodemailer (npm) Oct 27, 2026
StarPlatinu Credited to StarPlatinu
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service Moderate
GHSA-4g23-2xm8-66gc was published for nodemailer (npm) Oct 27, 2026
manus-use Credited to manus-use
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key High
CVE-2026-114612 was published for litellm (pip) Oct 27, 2026
Haruna38 Credited to Haruna38
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure High
CVE-2026-114613 was published for msgpack (pip) Oct 27, 2026
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment High
GHSA-j456-xh4h-cpf2 was published for nltk (pip) Oct 27, 2026
manus-use Credited to manus-use
Authlib: empty signatures validation in JWS JSON deserialization Critical
CVE-2026-96760 was published for authlib (pip) Oct 27, 2026
zer0d4y5 Credited to zer0d4y5, uziii2208, and nguyenminhtuan28 uziii2208 uziii2208
nguyenminhtuan28 nguyenminhtuan28
better-auth: Device login approval does not show the requesting client or permissions High
GHSA-q84f-53jg-9ppm was published for better-auth (npm) Oct 27, 2026
XlabAITeam Credited to XlabAITeam, keenanwgn, and liangjs keenanwgn keenanwgn
liangjs liangjs
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME Moderate
CVE-2026-114608 was published for pylint (pip) Oct 27, 2026
Satori-generated SVG has improper escaping Moderate
CVE-2026-94545 was published for satori (npm) Oct 27, 2026
RaghavMaheshwari124 Credited to RaghavMaheshwari124 and rafabd1 rafabd1 rafabd1
vllm p2p never connected zmq_exhaustion Moderate
CVE-2026-94624 was published for vllm (pip) Oct 27, 2026
yyymk Credited to yyymk and jperezdealgaba jperezdealgaba jperezdealgaba
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs High
CVE-2026-115924 was published for rembg (pip) Oct 27, 2026
rach1tarora Credited to rach1tarora
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation Low
CVE-2026-83813 was published for Twisted (pip) Oct 27, 2026
tinyb0y Credited to tinyb0y
Ghost: Authorization Bypass in Comment Like Feature Moderate
CVE-2026-103288 was published for ghost (npm) Oct 27, 2026
assakafpix Credited to assakafpix and Buggs777 Buggs777 Buggs777
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files Moderate
CVE-2026-60083 was published for github.com/siyuan-note/siyuan/kernel (Go) Oct 27, 2026
alham-rizvi Credited to alham-rizvi
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()' Moderate
CVE-2026-114610 was published for fpdf2 (pip) Oct 27, 2026
Dev-Winty Credited to Dev-Winty
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content Moderate
CVE-2026-114609 was published for fpdf2 (pip) Oct 27, 2026
BudongJW Credited to BudongJW, redyank, and manop55555 redyank redyank
manop55555 manop55555
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation High
CVE-2026-102554 was published for com.google.guava:guava (Maven) Oct 27, 2026
kemrec Credited to kemrec
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall` Critical
CVE-2026-35002 was published for agno (pip) Oct 27, 2026
harshsinha03 Credited to harshsinha03
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow High
CVE-2026-49272 was published for oauthlib (pip) Oct 27, 2026
hekhuisk Credited to hekhuisk
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) Critical
CVE-2026-48705 was published for monai (pip) Oct 27, 2026
cldrn Credited to cldrn
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS Low
CVE-2026-46350 was published for dcmjs (npm) Oct 27, 2026
cldrn Credited to cldrn
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins High
CVE-2026-34157 was published for github.com/wailsapp/wails/v2 (Go) Oct 27, 2026
Saku0512 Credited to Saku0512
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter High
CVE-2026-33944 was published for dolibarr/dolibarr (Composer) Oct 27, 2026
F37I5H Credited to F37I5H
Ajenti has potential Remote Code Execution High
CVE-2026-27975 was published for aj (pip) Oct 27, 2026
kiarn Credited to kiarn and wcakir wcakir wcakir
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database