Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,581
Rust
21

3,191 advisories

Loading
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service High
CVE-2026-118772 was published for @hapi/joi (npm) Oct 30, 2026
manus-use Credited to manus-use
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service High
CVE-2026-119202 was published for @hapi/content (npm) Oct 30, 2026
secalert Credited to secalert
Forge: Regular expression denial of service in PEM decoding (pem.decode) High
CVE-2026-118779 was published for node-forge (npm) Oct 30, 2026
AhmedMokhtari Credited to AhmedMokhtari, mwlik, imenyoo2, bibu123456, Kayiz-PT, and Mucahic mwlik mwlik
imenyoo2 imenyoo2 bibu123456 bibu123456 Kayiz-PT Kayiz-PT Mucahic Mucahic
Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count High
CVE-2026-118782 was published for node-forge (npm) Oct 30, 2026
Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message High
CVE-2026-119188 was published for node-forge (npm) Oct 30, 2026
Forge: Denial of service in TLS record processing via call stack exhaustion High
CVE-2026-119187 was published for node-forge (npm) Oct 30, 2026
Zyy0530 Credited to Zyy0530, 7thParkk, and Str1ckl4nd 7thParkk 7thParkk
Str1ckl4nd Str1ckl4nd
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 High
CVE-2026-119190 was published for node-forge (npm) Oct 30, 2026
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location High
CVE-2026-118763 was published for @sigstore/oci (npm) Oct 30, 2026
arpitjain099 Credited to arpitjain099
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects High
CVE-2026-116689 was published for follow-redirects (npm) Oct 30, 2026
burythevalley Credited to burythevalley
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options High
CVE-2026-119282 was published for @nx/gradle (npm) Oct 30, 2026
arkmarta Credited to arkmarta
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs High
CVE-2026-118664 was published for decode-uri-component (npm) Oct 29, 2026
gdegrange Credited to gdegrange
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy High
GHSA-w9x9-j56r-h98r was published for @eeacms/volto-chatbot (npm) Oct 29, 2026
EQSTLab Credited to EQSTLab
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY High
CVE-2026-62264 was published for @sylphx/pdf-reader-mcp (npm) Oct 29, 2026
novice-22 Credited to novice-22
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks High
CVE-2026-116576 was published for systeminformation (npm) Oct 28, 2026
itsFM-Codes Credited to itsFM-Codes
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) High
CVE-2026-116581 was published for seroval (npm) Oct 28, 2026
realies Credited to realies
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length High
CVE-2026-116584 was published for seroval (npm) Oct 28, 2026
llegomark Credited to llegomark
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check High
CVE-2026-116580 was published for seroval (npm) Oct 28, 2026
cruzryan Credited to cruzryan
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service High
CVE-2026-115887 was published for graphql-scalars (npm) Oct 28, 2026
pozylon Credited to pozylon, dotansimha, enisdenjo, Pteam-sa, and otavlna dotansimha dotansimha
enisdenjo enisdenjo Pteam-sa Pteam-sa otavlna otavlna
RE2JS: Quadratic-time denial of service in re2js lookbehind matching High
CVE-2026-116795 was published for re2js (npm) Oct 28, 2026
Nois3 Credited to Nois3
Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML High
CVE-2026-118660 was published for happy-dom (npm) Oct 28, 2026
TharVid Credited to TharVid
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages High
CVE-2026-118257 was published for @intlify/core (npm) Oct 28, 2026
lissy93 Credited to lissy93 and NotAFlightRisk NotAFlightRisk NotAFlightRisk
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications High
CVE-2026-118665 was published for @graphql-tools/executor-legacy-ws (npm) Oct 28, 2026
Highcharts Grid: `javascript:` URL in credits.href runs script on click High
CVE-2026-118255 was published for @highcharts/dashboards (npm) Oct 28, 2026
Highcharts Grid parses pagination language options as HTML High
CVE-2026-118254 was published for @highcharts/grid-lite (npm) Oct 28, 2026
Highcharts Dashboards parses fullscreen labels as HTML High
CVE-2026-118253 was published for @highcharts/dashboards (npm) Oct 28, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database