Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,600
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

223 advisories

Loading
Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of... High Unreviewed
CVE-2026-107576 was published Oct 8, 2026
Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMailServer allows a... High Unreviewed
CVE-2026-107574 was published Oct 8, 2026
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does... Moderate Unreviewed
CVE-2026-76271 was published Oct 7, 2026
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. ... Moderate Unreviewed
CVE-2026-84429 was published Oct 6, 2026
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line Moderate
GHSA-r4xh-jqrq-34v2 was published for smol-toml (npm) Oct 5, 2026
NotAFlightRisk Credited to NotAFlightRisk
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion Moderate
CVE-2026-104844 was published for postcss-selector-parser (npm) Oct 5, 2026
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk Moderate
CVE-2026-104182 was published for stream-json (npm) Oct 5, 2026
NotAFlightRisk Credited to NotAFlightRisk
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue... High Unreviewed
CVE-2026-96287 was published Oct 2, 2026
Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity... High Unreviewed
CVE-2026-94655 was published Oct 2, 2026
Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue... High Unreviewed
CVE-2026-94658 was published Oct 2, 2026
Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. This issue... High Unreviewed
CVE-2026-94653 was published Oct 2, 2026
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in... High Unreviewed
CVE-2026-96292 was published Oct 2, 2026
Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in... High Unreviewed
CVE-2026-104426 was published Oct 2, 2026
Inefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name... High Unreviewed
CVE-2026-103604 was published Oct 2, 2026
devalue: Residual sparse-array CPU amplification in uneval Moderate
GHSA-hx4r-w6wj-j8fg was published for devalue (npm) Oct 1, 2026
elliott-with-the-longest-name-on-github Credited to elliott-with-the-longest-name-on-github
pypdf: Possible long runtimes with large amount of embedded files High
CVE-2026-102999 was published for pypdf (pip) Oct 1, 2026
jungmingi-lab Credited to jungmingi-lab
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) High
CVE-2026-102997 was published for pypdf (pip) Oct 1, 2026
geoffrey-diederichs Credited to geoffrey-diederichs and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible long runtimes/large memory usage when parsing indirect objects High
CVE-2026-102994 was published for pypdf (pip) Oct 1, 2026
jankesec Credited to jankesec and stefan6419846 stefan6419846 stefan6419846
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan High
GHSA-3q6v-r5mr-hxv8 was published for league/commonmark (Composer) Sep 30, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) High
CVE-2026-90776 was published for nodemailer (npm) Sep 30, 2026
mmadersbacher Credited to mmadersbacher
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service Moderate
CVE-2026-102277 was published for brace-expansion (npm) Sep 29, 2026
G-Rath Credited to G-Rath and katzj katzj katzj
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service High
GHSA-v53p-9fqp-m79j was published for nodemailer (npm) Sep 29, 2026
Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as... Moderate Unreviewed
CVE-2026-42772 was published Sep 29, 2026
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds Moderate
GHSA-253c-mchw-3w2r was published for markdown-it (npm) Sep 29, 2026
NotAFlightRisk Credited to NotAFlightRisk and lissy93 lissy93 lissy93
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources Moderate
GHSA-r3ph-w7gj-g6xm was published for js-yaml (npm) Sep 29, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database