Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

565 advisories

Loading
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts Low
CVE-2026-114614 was published for authlib (pip) Oct 27, 2026
KrisKennawayDD Credited to KrisKennawayDD
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation Low
CVE-2026-83813 was published for Twisted (pip) Oct 27, 2026
tinyb0y Credited to tinyb0y
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database Low
CVE-2026-112913 was published for filelock (pip) Oct 23, 2026
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break Low
CVE-2026-112907 was published for filelock (pip) Oct 23, 2026
virtualenv: Pip seeding with download omits wheel digest verification Low
CVE-2026-113717 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Downloaded wheel selection and caching precede verification Low
CVE-2026-113714 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Venv configuration readback can reinterpret path boundaries Low
CVE-2026-113715 was published for virtualenv (pip) Oct 23, 2026
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description Low
GHSA-xmj3-9gf7-h52w was published for setuptools (pip) Oct 23, 2026
Hades2508 Credited to Hades2508
pypdf: Unvalidated JPEG image data loading Low
CVE-2026-113786 was published for pypdf (pip) Oct 21, 2026
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool Low
CVE-2026-113731 was published for djust (pip) Oct 21, 2026
KulFilip Credited to KulFilip
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies Low
CVE-2026-111749 was published for aiohttp (pip) Oct 20, 2026
denyspakizh-tob Credited to denyspakizh-tob and Dreamsorcerer Dreamsorcerer Dreamsorcerer
ClickMigrate has Path Traversal in "revision -m" argument Low
CVE-2026-68549 was published for ClickMigrate (pip) Oct 16, 2026
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction Low
CVE-2026-14966 was published for bbot (pip) Oct 14, 2026
tonghuaroot Credited to tonghuaroot
Apprise forwards configured auth headers across cross-origin HTTP redirects Low
CVE-2026-59180 was published for apprise (pip) Oct 14, 2026
gistrec Credited to gistrec
Strawberry legacy graphql-ws retains naturally completed subscription slots Low
CVE-2026-107727 was published for strawberry-graphql (pip) Oct 9, 2026
Hama1cco Credited to Hama1cco
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` Low
CVE-2026-107293 was published for pydantic-ai (pip) Oct 8, 2026
mauriceng98 Credited to mauriceng98 and sean-kim05 sean-kim05 sean-kim05
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False` Low
CVE-2026-107291 was published for pydantic-ai (pip) Oct 8, 2026
Docling: Configured HTTP headers sent to every remote image host named by a document Low
CVE-2026-105742 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle Low
CVE-2026-105752 was published for vllm (pip) Oct 6, 2026
KernelClint Credited to KernelClint, dhalf, and jperezdealgaba dhalf dhalf
jperezdealgaba jperezdealgaba
wlc may disclose API tokens to project-configured URLs Low
CVE-2026-62364 was published for wlc (pip) Sep 22, 2026
nijel Credited to nijel, type5afe, and visionxstack type5afe type5afe
visionxstack visionxstack
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` Low
GHSA-wwv5-g3v4-889x was published for tornado (pip) Sep 1, 2026
sec-reex Credited to sec-reex and arpitjain099 arpitjain099 arpitjain099
kas Persistently Disables SSH Host Key Checking Low
CVE-2026-54548 was published for kas (pip) Aug 26, 2026
shubtheone Credited to shubtheone
NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure Low
CVE-2026-71514 was published for nltk (pip) Aug 22, 2026
Wagtail: Identification of documents by SHA1 hash Low
GHSA-92hv-j533-69wc was published for wagtail (pip) Aug 20, 2026
gasman Credited to gasman, unknownhad, and RealOrangeOne unknownhad unknownhad
RealOrangeOne RealOrangeOne
MobSF has SSRF port restriction bypass in assetlinks_check Low
CVE-2026-68927 was published for mobsf (pip) Aug 18, 2026
DavidCarliez Credited to DavidCarliez
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database