Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

1,129 advisories

Loading
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability... Moderate Unreviewed
CVE-2026-85231 was published Oct 16, 2026
Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail... Moderate Unreviewed
CVE-2026-16251 was published Oct 16, 2026
Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10... Moderate Unreviewed
CVE-2026-19867 was published Oct 16, 2026
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation Moderate
CVE-2026-102682 was published for pipecat-ai (pip) Oct 15, 2026
infycore Credited to infycore and agent-kira agent-kira agent-kira
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression Moderate
CVE-2026-100350 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
matiasinsaurralde Credited to matiasinsaurralde
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion Moderate
CVE-2026-59951 was published for mcp (pip) Oct 15, 2026
rharang Credited to rharang, evilgensec, Madan301, subchat, and nickelsec evilgensec evilgensec
Madan301 Madan301 subchat subchat nickelsec nickelsec
A flaw was found in OpenSSH. After compression is negotiated, a compressed payload can expand... Moderate Unreviewed
CVE-2026-110927 was published Oct 15, 2026
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during... Moderate Unreviewed
CVE-2026-86561 was published Oct 14, 2026
BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in... Moderate Unreviewed
CVE-2026-110595 was published Oct 14, 2026
OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer... Moderate Unreviewed
CVE-2026-110591 was published Oct 14, 2026
OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons... Moderate Unreviewed
CVE-2026-110262 was published Oct 14, 2026
Allocation of resources without limits or throttling in SQL Server allows an authorized attacker... Moderate Unreviewed
CVE-2026-88084 was published Oct 13, 2026
Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker... Moderate Unreviewed
CVE-2026-96300 was published Oct 13, 2026
Allocation of resources without limits or throttling in Windows Netlogon allows an authorized... Moderate Unreviewed
CVE-2026-70072 was published Oct 13, 2026
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service... Moderate Unreviewed
CVE-2026-105466 was published Oct 12, 2026
SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout... Moderate Unreviewed
CVE-2026-109339 was published Oct 12, 2026
Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that... Moderate Unreviewed
CVE-2026-108755 was published Oct 11, 2026
Contao: The registration module re-sends activation mails Moderate
CVE-2026-107843 was published for contao/core-bundle (Composer) Oct 9, 2026
HDWSec Credited to HDWSec
An unauthenticated user with network access to the Ops Manager web port can repeatedly request... Moderate Unreviewed
CVE-2026-87110 was published Oct 9, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... Moderate Unreviewed
CVE-2026-78399 was published Oct 8, 2026
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash Moderate
CVE-2026-107379 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
ExPatch-LLC Credited to ExPatch-LLC
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB Moderate
CVE-2026-107386 was published for github.com/rabbitmq/amqp091-go (Go) Oct 8, 2026
timobrie Credited to timobrie and Zerpet Zerpet Zerpet
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl Moderate
CVE-2026-107294 was published for pydantic-ai (pip) Oct 8, 2026
Uncontrolled eviction in the browser session table of the REST API in Progressive Robot... Moderate Unreviewed
CVE-2026-107586 was published Oct 8, 2026
Uncontrolled eviction in the pending sign-in tables of the REST API in Progressive Robot... Moderate Unreviewed
CVE-2026-107585 was published Oct 8, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database