Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,191
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

37,565 advisories

Loading
Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735 Moderate
CVE-2026-55098 was published for github.com/basekick-labs/arc (Go) Nov 4, 2026
anir0y Credited to anir0y
@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter Moderate
CVE-2026-93363 was published for @payloadcms/storage-vercel-blob (npm) Nov 4, 2026
wsparks-vc Credited to wsparks-vc
odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values Moderate
CVE-2026-113787 was published for odf-kit (npm) Nov 4, 2026
PethuKannan Credited to PethuKannan
Stanza: RCE via pickle deserialization in the lemmatizer High
CVE-2026-115878 was published for stanza (pip) Nov 3, 2026
lexdotdev Credited to lexdotdev
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access Critical
CVE-2026-44267 was published for @enspirit/elo (npm) Nov 3, 2026
ultra-supara Credited to ultra-supara
Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels Critical
CVE-2026-44266 was published for @enspirit/elo (npm) Nov 3, 2026
ultra-supara Credited to ultra-supara
Elo backends have code injection via unvalidated emission of programmatic AST fields High
CVE-2026-44265 was published for @enspirit/elo (npm) Nov 3, 2026
ultra-supara Credited to ultra-supara
Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability High
GHSA-p3jp-9v83-76w9 was published for Microsoft.DotNet.ILCompiler (NuGet) Nov 3, 2026
praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection) High
CVE-2026-62331 was published for github.com/mtzanidakis/praktor (Go) Nov 3, 2026
tonghuaroot Credited to tonghuaroot
Keycloak has authentication bypass via jwt algorithm confusion High
CVE-2026-11800 was published for org.keycloak:keycloak-services (Maven) Nov 3, 2026
Netfoil doesn't decrement TTL Moderate
GHSA-9ppr-wfw9-xvr2 was published for github.com/tinfoil-factory/netfoil (Go) Nov 3, 2026
stigtsp Credited to stigtsp
Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution High
CVE-2026-62848 was published for Metalama.Framework (NuGet) Nov 3, 2026
Arc has unauthenticated application log disclosure via `/api/v1/logs` Low
GHSA-m3qr-fvp4-78xj was published for github.com/basekick-labs/arc (Go) Nov 3, 2026
sondt99 Credited to sondt99
DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation Moderate
GHSA-j656-3hf2-fvjc was published for @bytebase/dbhub (npm) Nov 2, 2026
canolgun Credited to canolgun
SD JWT JS: Tampered disclosures silently dropped instead of rejected High
CVE-2026-62374 was published for @sd-jwt/core (npm) Nov 2, 2026
tyche-dev Credited to tyche-dev
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory High
CVE-2026-118761 was published for github.com/kubeflow/pipelines (Go) Oct 30, 2026
bugbunny-research Credited to bugbunny-research
Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs High
CVE-2026-118759 was published for github.com/kubeflow/pipelines (Go) Oct 30, 2026
bugbunny-research Credited to bugbunny-research
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search High
CVE-2026-119203 was published for pypdf (pip) Oct 30, 2026
smaeljaish771 Credited to smaeljaish771
pypdf has possible large memory usage when parsing page tree High
CVE-2026-119204 was published for pypdf (pip) Oct 30, 2026
smaeljaish771 Credited to smaeljaish771
pypdf has possible infinite loop when cloning dictionaries High
CVE-2026-119205 was published for pypdf (pip) Oct 30, 2026
smaeljaish771 Credited to smaeljaish771 and KeenSecurityLab KeenSecurityLab KeenSecurityLab
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service High
CVE-2026-118772 was published for @hapi/joi (npm) Oct 30, 2026
manus-use Credited to manus-use
@hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service High
CVE-2026-119202 was published for @hapi/content (npm) Oct 30, 2026
secalert Credited to secalert
minimatch has potential denial of service via globparts amplification Moderate
CVE-2026-118764 was published for minimatch (npm) Oct 30, 2026
b1nv0id Credited to b1nv0id, ramonpzg, mgx-systems, 1abcdefggs, khucanhduy9-cloud, worldwideskier-alpine, and yadinesh1 ramonpzg ramonpzg
mgx-systems mgx-systems 1abcdefggs 1abcdefggs khucanhduy9-cloud khucanhduy9-cloud worldwideskier-alpine worldwideskier-alpine yadinesh1 yadinesh1
Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal Moderate
CVE-2026-118773 was published for glob (npm) Oct 30, 2026
Authlib RFC 7592 examples omit registration-access-token client binding High
CVE-2026-116672 was published for Authlib (pip) Oct 30, 2026
alham-rizvi Credited to alham-rizvi
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database