GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
7 advisories
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
High
CVE-2026-107227
was published
for
org.asynchttpclient:async-http-client
(Maven)
Oct 8, 2026
Ghost : Stored XSS via SVG Files in Content Imports
Moderate
CVE-2026-105644
was published
for
ghost
(npm)
Oct 7, 2026
Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method
High
CVE-2026-106440
was published
for
hydra-optuna-sweeper
(pip)
Oct 7, 2026
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Moderate
GHSA-3hv7-mjh2-fv65
was published
for
tornado
(pip)
Sep 30, 2026
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
Low
GHSA-p98j-92pf-mc4p
was published
for
dompurify
(npm)
Sep 30, 2026
league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scan
High
GHSA-3q6v-r5mr-hxv8
was published
for
league/commonmark
(Composer)
Sep 30, 2026
fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization
Moderate
CVE-2026-86818
was published
for
fast-uri
(npm)
Sep 29, 2026
ProTip!
Advisories are also available from the
GraphQL API