Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

181 advisories

Loading
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation Moderate
CVE-2026-102682 was published for pipecat-ai (pip) Oct 15, 2026
infycore Credited to infycore and agent-kira agent-kira agent-kira
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion Moderate
CVE-2026-59951 was published for mcp (pip) Oct 15, 2026
rharang Credited to rharang, evilgensec, Madan301, subchat, and nickelsec evilgensec evilgensec
Madan301 Madan301 subchat subchat nickelsec nickelsec
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl Moderate
CVE-2026-107294 was published for pydantic-ai (pip) Oct 8, 2026
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) Moderate
CVE-2026-105747 was published for docling (pip) Oct 6, 2026
jonathanlotan Credited to jonathanlotan and wittjeff wittjeff wittjeff
vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reach Moderate
CVE-2026-105758 was published for vllm (pip) Oct 5, 2026
0xiviel Credited to 0xiviel and jperezdealgaba jperezdealgaba jperezdealgaba
pypdf: Possible large memory usage when retrieving Roman page labels High
CVE-2026-102993 was published for pypdf (pip) Oct 1, 2026
Nivid42 Credited to Nivid42 and stefan6419846 stefan6419846 stefan6419846
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS Moderate
GHSA-3hv7-mjh2-fv65 was published for tornado (pip) Sep 30, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team and manus-pi manus-pi manus-pi
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory High
CVE-2026-97689 was published for urllib3 (pip) Sep 30, 2026
pquentin Credited to pquentin and illia-v illia-v illia-v
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) Moderate
CVE-2026-101917 was published for pyjwt (pip) Sep 29, 2026
babakizo420 Credited to babakizo420
Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service Moderate
CVE-2026-61541 was published for zapros (pip) Sep 23, 2026
Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb) High
CVE-2026-61652 was published for zapros (pip) Sep 23, 2026
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation Moderate
CVE-2026-77528 was published for autobahn (pip) Sep 22, 2026
hibrian827 Credited to hibrian827
AnyIO process-pool workers can block indefinitely on undrained stderr Moderate
CVE-2026-64847 was published for anyio (pip) Sep 18, 2026
vLLM: Request-selected PyNvVideoCodec GPU decode bypasses static VRAM reservation Moderate
CVE-2026-69147 was published for vllm (pip) Sep 17, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions Moderate
CVE-2026-57173 was published for vllm (pip) Sep 16, 2026
koonnamchok Credited to koonnamchok, DarkLight1337, and jperezdealgaba DarkLight1337 DarkLight1337
jperezdealgaba jperezdealgaba
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout High
CVE-2026-87011 was published for open-webui (pip) Sep 10, 2026
galanko Credited to galanko and Classic298 Classic298 Classic298
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds Moderate
CVE-2026-71486 was published for vllm (pip) Sep 4, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) Moderate
GHSA-8423-8fgw-73vq was published for tornado (pip) Sep 1, 2026
Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data` Moderate
CVE-2026-73228 was published for djangorestframework (pip) Sep 1, 2026
zainnadeem786 Credited to zainnadeem786
eml_parser vulnerable to DoS via deeply nested parens in Received headers High
CVE-2026-55620 was published for eml_parser (pip) Aug 25, 2026
Sebasteuo Credited to Sebasteuo
eml_parser has parser DoS via deeply nested parentheses in e-mail headers Moderate
CVE-2026-55619 was published for eml_parser (pip) Aug 25, 2026
Sebasteuo Credited to Sebasteuo
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced) Moderate
CVE-2026-55531 was published for PraisonAI (pip) Aug 25, 2026
geo-chen Credited to geo-chen
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service Moderate
GHSA-jgvr-6x5w-hx5w was published for kcl-lib (pip) Aug 20, 2026
maxammann Credited to maxammann
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard High
GHSA-j659-8xh6-5pq5 was published for atomic-agents-stack (pip) Aug 17, 2026
Keras model loading is vulnerable to denial of service through HDF5 shape bombs Moderate
CVE-2026-12570 was published for keras (pip) Aug 10, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database