Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

64 advisories

Loading
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of... Unknown Unreviewed
CVE-2026-85783 was published Oct 21, 2026
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) High
CVE-2026-111752 was published for @angular/router (npm) Oct 20, 2026
SkyZeroZx Credited to SkyZeroZx, atscott, and alan-agius4 atscott atscott
alan-agius4 alan-agius4
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent... Unknown Unreviewed
CVE-2026-110676 was published Oct 19, 2026
Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability High
CVE-2026-96960 was published for System.Security.Cryptography.Xml (NuGet) Oct 13, 2026
Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability Moderate
CVE-2026-70162 was published for System.Security.Cryptography.Pkcs (NuGet) Oct 13, 2026
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client... High Unreviewed
CVE-2026-97031 was published Oct 9, 2026
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0... High Unreviewed
CVE-2026-15822 was published Oct 8, 2026
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request... High Unreviewed
CVE-2026-104712 was published Oct 5, 2026
Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers... High Unreviewed
CVE-2026-104431 was published Oct 2, 2026
ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows... Moderate Unreviewed
CVE-2026-104425 was published Oct 2, 2026
Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows... High Unreviewed
CVE-2026-104423 was published Oct 2, 2026
Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password... High Unreviewed
CVE-2026-103880 was published Oct 2, 2026
In a query response, an attacker may send `named` multiple copies of a record that should only... Moderate Unreviewed
CVE-2026-75029 was published Sep 16, 2026
Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search... Low Unreviewed
CVE-2026-68531 was published Sep 15, 2026
Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout High
CVE-2026-87011 was published for open-webui (pip) Sep 10, 2026
galanko Credited to galanko and Classic298 Classic298 Classic298
commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in... Moderate Unreviewed
CVE-2026-86432 was published Sep 7, 2026
pypdf: Possible long runtimes/large memory usage when retrieving outlines Moderate
CVE-2026-84310 was published for pypdf (pip) Sep 1, 2026
stefan6419846 Credited to stefan6419846 and HYUNSUNG03 HYUNSUNG03 HYUNSUNG03
decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input Moderate
CVE-2026-45822 was published for decode-uri-component (npm) Aug 31, 2026
bnbdr Credited to bnbdr
Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes... High Unreviewed
CVE-2026-54874 was published Aug 25, 2026
An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by... Moderate Unreviewed
CVE-2026-23930 was published Aug 18, 2026
An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by... Moderate Unreviewed
CVE-2026-23934 was published Aug 18, 2026
league/commonmark: Denial of service via deeply nested XML output Moderate
GHSA-mj63-m3rc-8ppr was published for league/commonmark (Composer) Aug 6, 2026
GrahamCampbell Credited to GrahamCampbell
UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to... High Unreviewed
CVE-2026-54224 was published Jun 18, 2026
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of... Moderate Unreviewed
CVE-2026-8594 was published May 30, 2026
Nerdbank.MessagePack has a memory amplification DoS in collection deserialization Moderate
GHSA-qjvr-435c-5fjh was published for Nerdbank.MessagePack (NuGet) May 29, 2026
svenclaesson Credited to svenclaesson and AArnott AArnott AArnott
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database