Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,129 advisories

Loading
A user account with permission to deploy artifacts to a hosted Maven repository could upload a... Moderate Unreviewed
CVE-2026-77121 was published Sep 2, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial... Moderate Unreviewed
CVE-2026-78588 was published Sep 2, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of... Moderate Unreviewed
CVE-2026-78586 was published Sep 2, 2026
qs array-limit bypass via bracket-key comma parsing Moderate
CVE-2026-82562 was published for qs (npm) Sep 2, 2026
Vectrain51 Credited to Vectrain51, Fcmam5, and ljharb Fcmam5 Fcmam5
ljharb ljharb
Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions. Moderate Unreviewed
CVE-2026-84775 was published Sep 2, 2026
Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. Moderate Unreviewed
CVE-2026-84780 was published Sep 2, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of... Moderate Unreviewed
CVE-2026-72652 was published Sep 1, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a... Moderate Unreviewed
CVE-2026-56143 was published Sep 1, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of... Moderate Unreviewed
CVE-2026-72682 was published Sep 1, 2026
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of... Moderate Unreviewed
CVE-2026-33465 was published Sep 1, 2026
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) Moderate
GHSA-8423-8fgw-73vq was published for tornado (pip) Sep 1, 2026
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data` Moderate
CVE-2026-73228 was published for djangorestframework (pip) Sep 1, 2026
zainnadeem786 Credited to zainnadeem786
IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of... Moderate Unreviewed
CVE-2026-3686 was published Aug 29, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation Moderate
CVE-2026-55407 was published for buffa (Rust) Aug 28, 2026
p80n-sec Credited to p80n-sec
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client... Moderate Unreviewed
CVE-2026-59287 was published Aug 27, 2026
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode... Moderate Unreviewed
CVE-2026-47859 was published Aug 27, 2026
The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection... Moderate Unreviewed
CVE-2026-47874 was published Aug 27, 2026
Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle... Moderate Unreviewed
CVE-2026-71054 was published Aug 26, 2026
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19... Moderate Unreviewed
CVE-2026-77801 was published Aug 26, 2026
eml_parser has parser DoS via deeply nested parentheses in e-mail headers Moderate
CVE-2026-55619 was published for eml_parser (pip) Aug 25, 2026
Sebasteuo Credited to Sebasteuo
Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches additional certificates ... Moderate Unreviewed
CVE-2026-63074 was published Aug 25, 2026
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced) Moderate
CVE-2026-55531 was published for PraisonAI (pip) Aug 25, 2026
geo-chen Credited to geo-chen
Ech0 through 4.5.6 registers the PUT /api/echo/like/:id endpoint on the public router group... Moderate Unreviewed
CVE-2026-79661 was published Aug 25, 2026
vibeio-http has a DoS vulnerability in HTTP/1.x chunked encoding parser triggered by maliciously crafted chunk lengths Moderate
GHSA-fx4f-mhw4-qm7j was published for vibeio-http (Rust) Aug 24, 2026
The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or... Moderate Unreviewed
CVE-2026-78321 was published Aug 24, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database