Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

37,305 advisories

Loading
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects High
CVE-2026-109829 was published for undici (npm) Oct 27, 2026
Kushalkhemka Credited to Kushalkhemka, mayank-jangid-moon, skigeek16, opensec-intelligence, bengsky13, mcollina, and UlisesGascon mayank-jangid-moon mayank-jangid-moon
skigeek16 skigeek16 opensec-intelligence opensec-intelligence bengsky13 bengsky13 mcollina mcollina UlisesGascon UlisesGascon
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent High
CVE-2026-109383 was published for undici (npm) Oct 27, 2026
euriconicacio Credited to euriconicacio, BlueN0r, ksanjeev284, mcollina, and UlisesGascon BlueN0r BlueN0r
ksanjeev284 ksanjeev284 mcollina mcollina UlisesGascon UlisesGascon
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation High
CVE-2026-87018 was published for undici (npm) Oct 27, 2026
benzdeus Credited to benzdeus, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering Moderate
CVE-2026-109932 was published for undici (npm) Oct 27, 2026
benzdeus Credited to benzdeus, UlisesGascon, and mcollina UlisesGascon UlisesGascon
mcollina mcollina
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor Moderate
CVE-2026-87029 was published for undici (npm) Oct 27, 2026
Yanhaoxi Credited to Yanhaoxi, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length High
GHSA-f897-62hf-6gxq was published for @modelcontextprotocol/hono (npm) Oct 27, 2026
cybercraftsolutionsllc Credited to cybercraftsolutionsllc, hewei-gikaku, Jvr2022, Gal3m, mohammad228, shmulc8, JustasMonkev, and subchat hewei-gikaku hewei-gikaku
Jvr2022 Jvr2022 Gal3m Gal3m mohammad228 mohammad228 shmulc8 shmulc8 JustasMonkev JustasMonkev subchat subchat
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process High
CVE-2026-109413 was published for symfony/symfony (Composer) Oct 27, 2026
nicolas-grekas Credited to nicolas-grekas
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header High
CVE-2026-108082 was published for symfony/http-foundation (Composer) Oct 27, 2026
r3verii Credited to r3verii, nicolas-grekas, and duartecsantos nicolas-grekas nicolas-grekas
duartecsantos duartecsantos
Go JOSE: DoS when parsing JWKs that contain RSA keys High
CVE-2026-116587 was published for github.com/go-jose/go-jose/v3 (Go) Oct 27, 2026
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values High
CVE-2026-116683 was published for github.com/ctfer-io/terraform-provider-ctfd (Go) Oct 27, 2026
kta1kri Credited to kta1kri
Hydra legacy target blacklist permits unsafe PyYAML loading High
GHSA-wf6j-7hvr-gr93 was published for hydra-core (pip) Oct 27, 2026
qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) Moderate
CVE-2026-110816 was published for qs (npm) Oct 27, 2026
manus-pi Credited to manus-pi, Lucidsec, and manus-use Lucidsec Lucidsec
manus-use manus-use
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake High
CVE-2026-109855 was published for undici (npm) Oct 27, 2026
kjsik11 Credited to kjsik11, mcollina, jasnell, metcoder95, and UlisesGascon mcollina mcollina
jasnell jasnell metcoder95 metcoder95 UlisesGascon UlisesGascon
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) High
CVE-2026-114616 was published for Authlib (pip) Oct 27, 2026
clzoom Credited to clzoom, tonghuaroot, and ksanjeev284 tonghuaroot tonghuaroot
ksanjeev284 ksanjeev284
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert Low
GHSA-vp88-798v-h67f was published for rustls (Rust) Oct 27, 2026
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share Low
GHSA-w44r-93j7-qv28 was published for rustls (Rust) Oct 27, 2026
Adam010341 Credited to Adam010341
Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs Moderate
GHSA-c8m5-c952-6cm4 was published for rustls (Rust) Oct 27, 2026
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. Low
GHSA-h2v8-394m-p7vv was published for rustls (Rust) Oct 27, 2026
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF Moderate
CVE-2026-114620 was published for authlib (pip) Oct 27, 2026
priyankn Credited to priyankn
Authlib: ID token can disable its own nonce validation via the nonce_supported claim Moderate
CVE-2026-114617 was published for authlib (pip) Oct 27, 2026
chan154 Credited to chan154
Authlib: Default JWT bearer grant accepts assertions for the wrong audience Moderate
CVE-2026-114618 was published for authlib (pip) Oct 27, 2026
mauriceng98 Credited to mauriceng98, EQSTLab, and alham-rizvi EQSTLab EQSTLab
alham-rizvi alham-rizvi
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens Moderate
CVE-2026-114619 was published for authlib (pip) Oct 27, 2026
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys High
CVE-2026-114615 was published for authlib (pip) Oct 27, 2026
zer0d4y5 Credited to zer0d4y5
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading Moderate
CVE-2026-108360 was published for phpoffice/phpspreadsheet (Composer) Oct 27, 2026
manus-use Credited to manus-use, alimony, arpitjain099, nikolakojic-rasit, and manus-pi alimony alimony
arpitjain099 arpitjain099 nikolakojic-rasit nikolakojic-rasit manus-pi manus-pi
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) High
CVE-2026-108359 was published for phpoffice/phpspreadsheet (Composer) Oct 27, 2026
luantq0 Credited to luantq0 and euriconicacio euriconicacio euriconicacio
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database