Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,129 advisories

Loading
AnyIO process-pool workers can block indefinitely on undrained stderr Moderate
CVE-2026-64847 was published for anyio (pip) Sep 18, 2026
A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can... Moderate Unreviewed
CVE-2026-10832 was published Sep 18, 2026
Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass Moderate
CVE-2026-77281 was published for github.com/caddyserver/caddy/v2 (Go) Sep 18, 2026
WhiskerEnt Credited to WhiskerEnt
Svelte devalue: DoS via malformed input Moderate
CVE-2026-81176 was published for devalue (npm) Sep 17, 2026
Rich-Harris Credited to Rich-Harris, kq5y, and elliott-with-the-longest-name-on-github kq5y kq5y
elliott-with-the-longest-name-on-github elliott-with-the-longest-name-on-github
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation Moderate
CVE-2026-69147 was published for vllm (pip) Sep 17, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access... Moderate Unreviewed
CVE-2026-92915 was published Sep 17, 2026
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions Moderate
CVE-2026-57173 was published for vllm (pip) Sep 16, 2026
koonnamchok Credited to koonnamchok, DarkLight1337, and jperezdealgaba DarkLight1337 DarkLight1337
jperezdealgaba jperezdealgaba
Novel vulnerabilities to launch algorithmic complexity attacks on DNSSEC have been researched... Moderate Unreviewed
CVE-2026-85501 was published Sep 16, 2026
In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is... Moderate Unreviewed
CVE-2026-80225 was published Sep 16, 2026
Denial-of-service in the SVG component. This vulnerability was fixed in Firefox 156 and Firefox... Moderate Unreviewed
CVE-2026-92077 was published Sep 15, 2026
Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156 and... Moderate Unreviewed
CVE-2026-92078 was published Sep 15, 2026
Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156. Moderate Unreviewed
CVE-2026-92063 was published Sep 15, 2026
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and... Moderate Unreviewed
CVE-2026-86892 was published Sep 14, 2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22... Moderate Unreviewed
CVE-2026-11993 was published Sep 14, 2026
Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded Moderate
CVE-2026-88012 was published for github.com/traefik/traefik/v2 (Go) Sep 10, 2026
ShadMalloy Credited to ShadMalloy
Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and... Moderate Unreviewed
CVE-2026-88878 was published Sep 10, 2026
PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket... Moderate Unreviewed
CVE-2023-54394 was published Sep 9, 2026
In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent... Moderate Unreviewed
CVE-2026-28633 was published Sep 8, 2026
Allocation of resources without limits or throttling in Active Directory Federation Services (AD... Moderate Unreviewed
CVE-2026-72978 was published Sep 8, 2026
Allocation of resources without limits or throttling in Windows SMB Server allows an authorized... Moderate Unreviewed
CVE-2026-69374 was published Sep 8, 2026
Allocation of Resources Without Limits or Throttling in ASUS Armoury Crate allows a local user to... Moderate Unreviewed
CVE-2026-75808 was published Sep 8, 2026
PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to... Moderate Unreviewed
CVE-2022-51008 was published Sep 6, 2026
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds Moderate
CVE-2026-71486 was published for vllm (pip) Sep 4, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk... Moderate Unreviewed
CVE-2026-71219 was published Sep 3, 2026
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses... Moderate Unreviewed
CVE-2026-71224 was published Sep 3, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database