Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

107 advisories

Loading
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder High
CVE-2026-77622 was published for github.com/BishopFox/sliver (Go) Oct 15, 2026
CalebKingan Credited to CalebKingan and Squ1shification Squ1shification Squ1shification
Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API High
CVE-2026-91970 was published for code.vikunja.io/api (Go) Oct 9, 2026
Zyy0530 Credited to Zyy0530, Str1ckl4nd, and 7thParkk Str1ckl4nd Str1ckl4nd
7thParkk 7thParkk
Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API High
GHSA-c2g7-39fr-cp8q was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
Vikunja: Denial of service via decompression bomb in the data import High
CVE-2026-91979 was published for code.vikunja.io/api (Go) Oct 9, 2026
Str1ckl4nd Credited to Str1ckl4nd, 7thParkk, 0xcelien, and JellowBeanz26 7thParkk 7thParkk
0xcelien 0xcelien JellowBeanz26 JellowBeanz26
Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days High
CVE-2026-107212 was published for github.com/xuri/excelize/v2 (Go) Oct 8, 2026
Coraza: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding High
CVE-2026-41510 was published for github.com/corazawaf/coraza/v3 (Go) Oct 6, 2026
fzipi Credited to fzipi and WalTeR-RE WalTeR-RE WalTeR-RE
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS) High
CVE-2026-86065 was published for github.com/klever-io/klever-go (Go) Sep 23, 2026
ch4r0utf8 Credited to ch4r0utf8
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service High
CVE-2026-77633 was published for github.com/cloudreve/Cloudreve/v4 (Go) Sep 22, 2026
newugly Credited to newugly
Traefik vulnerable to HTTP/2 request causing denial of service High
CVE-2023-54365 was published for github.com/traefik/traefik (Go) Oct 17, 2023
Duplicate Advisory: Traefik vulnerable to HTTP/2 request causing denial of service High
GHSA-pvrg-q6jw-42p7 was published for github.com/traefik/traefik (Go) Jun 23, 2026 • withdrawn
Grafana: Pre-authentication denial of service in the public dashboard query handler High
CVE-2026-42127 was published for github.com/grafana/grafana (Go) Jun 22, 2026
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware High
CVE-2026-61629 was published for github.com/lucasdillmann/nginx-ignition (Go) Sep 21, 2026
tonghuaroot Credited to tonghuaroot and lucasdillmann lucasdillmann lucasdillmann
CoreDNS: Unauthenticated memory exhaustion in custom transports High
CVE-2026-82399 was published for github.com/coredns/coredns (Go) Sep 17, 2026
thevilledev Credited to thevilledev
RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation High
CVE-2026-77403 was published for github.com/rabbitmq/amqp091-go (Go) Sep 17, 2026
suchitd Credited to suchitd
Excelize: Streaming GetRows row-bound bypass causes attacker-controlled allocation High
CVE-2026-59161 was published for github.com/xuri/excelize (Go) Sep 10, 2026
DavidCarliez Credited to DavidCarliez
amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload High
CVE-2026-79921 was published for github.com/rabbitmq/amqp091-go (Go) Sep 3, 2026
suchitd Credited to suchitd
Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes High
CVE-2026-45713 was published for github.com/axllent/mailpit (Go) May 19, 2026
KadirArslan Credited to KadirArslan
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling High
CVE-2026-67446 was published for github.com/axllent/mailpit (Go) Sep 2, 2026
rexpository Credited to rexpository
libp2p nodes vulnerable to attack using large RSA keys High
CVE-2023-39533 was published for github.com/libp2p/go-libp2p (Go) Aug 9, 2023
marten-seemann Credited to marten-seemann and simonmorley simonmorley simonmorley
New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging High
CVE-2026-64868 was published for github.com/QuantumNous/new-api (Go) Aug 17, 2026
passer12 Credited to passer12
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline High
CVE-2026-73500 was published for go.etcd.io/etcd/v3 (Go) Jul 24, 2026
Gophish contains a denial of service vulnerability High
CVE-2026-39904 was published for github.com/gophish/gophish (Go) Jun 22, 2026
ashikmd7 Credited to ashikmd7
OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) High
CVE-2026-67437 was published for github.com/OliveTin/OliveTin (Go) Jul 30, 2026
knight-yagami Credited to knight-yagami
td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode High
CVE-2026-54638 was published for github.com/gotd/td (Go) Jul 28, 2026
ayman148754-cloud Credited to ayman148754-cloud
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities High
GHSA-hrxh-6v49-42gf was published for google.golang.org/grpc (Go) Jul 21, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database