Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

1,561 advisories

Loading
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores Moderate
CVE-2026-115883 was published for langgraph-checkpoint-postgres (pip) Oct 23, 2026
VuxNx Credited to VuxNx
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient Moderate
GHSA-8c8m-p3m8-cjg8 was published for nodemailer (npm) Oct 23, 2026
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient Moderate
GHSA-m943-m63m-w62w was published for nodemailer (npm) Oct 23, 2026
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name Moderate
GHSA-85x2-q946-cp5h was published for nodemailer (npm) Oct 23, 2026
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization Moderate
CVE-2026-110180 was published for fast-uri (npm) Oct 23, 2026
UlisesGascon Credited to UlisesGascon and mcollina mcollina mcollina
pypdf: Unvalidated JPEG image data loading Low
CVE-2026-113786 was published for pypdf (pip) Oct 21, 2026
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path Moderate
CVE-2026-100347 was published for github.com/getkin/kin-openapi (Go) Oct 15, 2026
manus-use Credited to manus-use
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image) High
CVE-2026-84316 was published for github.com/0xJacky/Nginx-UI (Go) Oct 15, 2026
novice-22 Credited to novice-22
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image) High
CVE-2026-84317 was published for github.com/0xJacky/Nginx-UI (Go) Oct 15, 2026
novice-22 Credited to novice-22
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination Moderate
CVE-2026-48484 was published for pyload-ng (pip) Oct 9, 2026
pevinkumar10 Credited to pevinkumar10
Hazelcast allows arbitrary member memory access by low-privileged client Critical
CVE-2026-107726 was published for com.hazelcast:hazelcast (Maven) Oct 8, 2026
k-jamroz Credited to k-jamroz
Banks: User-controlled prompt input can be parsed as privileged chat messages Moderate
CVE-2026-107717 was published for banks (pip) Oct 8, 2026
swordmein Credited to swordmein
fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set High
CVE-2026-107720 was published for fast-jwt (npm) Oct 8, 2026
Char0n1507 Credited to Char0n1507
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface High
CVE-2026-61427 was published for praisonai (pip) Oct 8, 2026
dinhvaren Credited to dinhvaren
Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection Moderate
GHSA-w253-m66g-rx24 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
MushroomWasp Credited to MushroomWasp
Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules Moderate
GHSA-3wr7-993q-jrff was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
airween Credited to airween and janmrow janmrow janmrow
Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations Moderate
CVE-2026-107825 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection Moderate
GHSA-5gj4-9gm7-2fx2 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
MushroomWasp Credited to MushroomWasp
Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml Moderate
CVE-2026-107225 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE High
CVE-2026-106443 was published for WeasyPrint (pip) Oct 7, 2026
svinkros Credited to svinkros
Backstage: Improper entity validation in deprecated Kubernetes services endpoint Moderate
CVE-2026-106563 was published for @backstage/plugin-kubernetes-backend (npm) Oct 7, 2026
Backstage: Improper input validation in proxy-backend Moderate
CVE-2026-106491 was published for @backstage/plugin-proxy-backend (npm) Oct 7, 2026
Coraza: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling Moderate
CVE-2026-41508 was published for github.com/corazawaf/coraza/v3 (Go) Oct 6, 2026
fzipi Credited to fzipi
PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryption Moderate
CVE-2026-96747 was published for pymongo (pip) Oct 5, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database