Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

65 advisories

Loading
OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission... Low Unreviewed
CVE-2026-107885 was published Oct 9, 2026
A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for... Low Unreviewed
CVE-2026-101333 was published Sep 28, 2026
A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote... Low Unreviewed
CVE-2026-85220 was published Sep 21, 2026
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without... Low Unreviewed
CVE-2025-52657 was published Sep 7, 2026
Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream... Low Unreviewed
CVE-2026-59303 was published Aug 27, 2026
BuildKit has a possible runtime DoS via unbounded group parsing Low
CVE-2026-61712 was published for github.com/moby/buildkit (Go) Aug 19, 2026
IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local... Low Unreviewed
CVE-2026-18096 was published Aug 12, 2026
ImageMagick: Policy Bypass possible with matrix-backed operations Low
GHSA-rvhp-75f6-9jqh was published for Magick.NET-Q16-AnyCPU (NuGet) Jul 24, 2026
rexpository Credited to rexpository
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement Low
CVE-2026-12590 was published for body-parser (npm) Jul 20, 2026
Phillip9587 Credited to Phillip9587, efekrskl, UlisesGascon, and bjohansebas efekrskl efekrskl
UlisesGascon UlisesGascon bjohansebas bjohansebas
Duplicate Advisory: SurrealDB no JavaScript script function default timeout could facilitate DoS Low
GHSA-6g9r-xqrf-34xh was published for surrealdb (Rust) Jul 18, 2026 • withdrawn
sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource... Low Unreviewed
CVE-2026-60000 was published Jul 8, 2026
Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length Low
GHSA-h72h-ppcx-998p was published for zebra-network (Rust) Jul 2, 2026
ouicate Credited to ouicate and oxarbitrage oxarbitrage oxarbitrage
zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length Low
GHSA-443g-gwgp-49x4 was published for zebra-chain (Rust) Jul 2, 2026
dingledropper Credited to dingledropper, mpguerra, and oxarbitrage mpguerra mpguerra
oxarbitrage oxarbitrage
@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url Low
GHSA-rp72-5v5q-2446 was published for @cardano402/mcp-server (npm) Jun 26, 2026
MorganOnCode Credited to MorganOnCode
fluent-plugin-s3 Vulnerable to Denial of Service (DoS) via Decompression Bomb in `in_s3` Low
CVE-2026-44162 was published for fluent-plugin-s3 (RubyGems) Jun 26, 2026
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest... Low Unreviewed
CVE-2026-13322 was published Jun 26, 2026
symfony/ux-live-component: Denial of service via unbounded batch action requests Low
CVE-2026-49209 was published for symfony/ux-live-component (Composer) Jun 19, 2026
Amoifr Credited to Amoifr and Kocal Kocal Kocal
Pterodactyl has a database resource limit bypass via race condition in Client API Low
CVE-2026-35202 was published for pterodactyl/panel (Composer) May 26, 2026
UDPSendToFailed Credited to UDPSendToFailed
twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments Low
CVE-2026-46629 was published for twig/intl-extra (Composer) May 21, 2026
NocoDB: Attachment Size Limit Bypass via Upload-by-URL Low
CVE-2026-46553 was published for nocodb (npm) May 21, 2026
bugbunny-research Credited to bugbunny-research
An unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2... Low Unreviewed
CVE-2026-44070 was published May 21, 2026
aiograpi has dependency on vulnerable orjson 3.11.4 (CVE-2025-67221) Low
GHSA-7mw3-79jq-xc7f was published for aiograpi (pip) May 6, 2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition... Low Unreviewed
CVE-2026-22018 was published Apr 21, 2026
OpenBao: Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS) Low
CVE-2026-39396 was published for github.com/openbao/openbao (Go) Apr 21, 2026
n1rwhex Credited to n1rwhex
Mattermost MS Teams plugin doesn't limit the request body size on the /lifecycle webhook endpoint Low
CVE-2026-21388 was published for github.com/mattermost/mattermost-plugin-msteams (Go) Apr 9, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database