Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

6,706 advisories

Loading
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name Moderate
CVE-2026-112937 was published for filelock (pip) Oct 23, 2026
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database Low
CVE-2026-112913 was published for filelock (pip) Oct 23, 2026
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break Low
CVE-2026-112907 was published for filelock (pip) Oct 23, 2026
virtualenv: Temporary app-data can leave dangling seed package links Moderate
CVE-2026-113713 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Pip seeding with download omits wheel digest verification Low
CVE-2026-113717 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Downloaded wheel selection and caching precede verification Low
CVE-2026-113714 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Xonsh activation literals depend on the script decoding codec High
CVE-2026-113718 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Seeded files retain permissions from an older cache Moderate
CVE-2026-113720 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Bash prompt values can change meaning under older compatibility modes High
CVE-2026-113723 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Venv configuration readback can reinterpret path boundaries Low
CVE-2026-113715 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Seed replacement does not contain metadata deletion paths Moderate
CVE-2026-113719 was published for virtualenv (pip) Oct 23, 2026
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints Moderate
CVE-2026-115886 was published for mlflow (pip) Oct 23, 2026
adamyordan Credited to adamyordan
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores Moderate
CVE-2026-115883 was published for langgraph-checkpoint-postgres (pip) Oct 23, 2026
VuxNx Credited to VuxNx and oct0pus7 oct0pus7 oct0pus7
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse Moderate
CVE-2026-112906 was published for filelock (pip) Oct 23, 2026
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory Moderate
CVE-2026-112914 was published for filelock (pip) Oct 23, 2026
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files High
CVE-2026-112940 was published for filelock (pip) Oct 23, 2026
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution Critical
CVE-2026-112398 was published for pillow (pip) Oct 23, 2026
pebwalker Credited to pebwalker
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1 Moderate
CVE-2026-114501 was published for Pillow (pip) Oct 23, 2026
akx Credited to akx
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description Low
GHSA-xmj3-9gf7-h52w was published for setuptools (pip) Oct 23, 2026
Hades2508 Credited to Hades2508
FastMCP: Post-transform component authorization is skipped on direct calls Moderate
GHSA-7xgj-8392-5q4r was published for fastmcp (pip) Oct 23, 2026
rishid Credited to rishid
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server Moderate
GHSA-vqqp-x5qm-5qp4 was published for fastmcp (pip) Oct 23, 2026
LHMisme420 Credited to LHMisme420
vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.) High
CVE-2026-114055 was published for vllm (pip) Oct 23, 2026
Chedrian07 Credited to Chedrian07, jperezdealgaba, and DarkLight1337 jperezdealgaba jperezdealgaba
DarkLight1337 DarkLight1337
pypdf: Possible long runtimes for repeated references to the same missing object High
CVE-2026-115572 was published for pypdf (pip) Oct 23, 2026
manop55555 Credited to manop55555
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) High
CVE-2026-115585 was published for pypdf (pip) Oct 23, 2026
kyrux29 Credited to kyrux29, loegaire, and stefan6419846 loegaire loegaire
stefan6419846 stefan6419846
pypdf: Possible long runtimes for large xref table header limits High
CVE-2026-115580 was published for pypdf (pip) Oct 23, 2026
ducanhmit Credited to ducanhmit and stefan6419846 stefan6419846 stefan6419846
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database