Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

253 advisories

Loading
HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by... Unknown Unreviewed
CVE-2026-115825 was published Oct 25, 2026
Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header... Unknown Unreviewed
CVE-2026-114629 was published Oct 24, 2026
Ghidra through 12.2 contains an uncontrolled memory allocation vulnerability in BinaryField.read(... Moderate Unreviewed
CVE-2026-115394 was published Oct 22, 2026
Pillow: APNG background disposal allocates full canvas before decompression bomb check High
CVE-2026-112399 was published for Pillow (pip) Oct 21, 2026
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's... Moderate Unreviewed
CVE-2026-113604 was published Oct 20, 2026
VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in... Moderate Unreviewed
CVE-2026-112283 was published Oct 19, 2026
A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index... Moderate Unreviewed
CVE-2026-112214 was published Oct 19, 2026
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing... Moderate Unreviewed
CVE-2026-112048 was published Oct 18, 2026
swoosh has email-derived URL path injection in Microsoft Graph endpoint Low
CVE-2026-54893 was published for swoosh (Erlang) Oct 16, 2026
PJUllrich Credited to PJUllrich, maennchen, and princemaple maennchen maennchen
princemaple princemaple
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows... High Unreviewed
CVE-2026-111279 was published Oct 16, 2026
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... High Unreviewed
CVE-2026-102463 was published Oct 15, 2026
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... High Unreviewed
CVE-2026-102466 was published Oct 15, 2026
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... High Unreviewed
CVE-2026-103223 was published Oct 15, 2026
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... High Unreviewed
CVE-2026-103224 was published Oct 15, 2026
OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label... Moderate Unreviewed
CVE-2026-110258 was published Oct 14, 2026
OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader... Moderate Unreviewed
CVE-2026-110257 was published Oct 14, 2026
Memory allocation with excessive size value in Active Directory Federation Services (AD FS)... High Unreviewed
CVE-2026-85324 was published Oct 13, 2026
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts... High Unreviewed
CVE-2020-37280 was published Oct 12, 2026
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that... High Unreviewed
CVE-2026-108106 was published Oct 9, 2026
music-metadata: Uncontrolled memory allocation in APEv2 parser Moderate
CVE-2026-107387 was published for music-metadata (npm) Oct 8, 2026
Zwique Credited to Zwique
music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoS Moderate
CVE-2026-107388 was published for music-metadata (npm) Oct 8, 2026
Zwique Credited to Zwique
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort Moderate
CVE-2026-107389 was published for music-metadata (npm) Oct 8, 2026
bg0d-glitch Credited to bg0d-glitch, Zwique, offset, and arpitjain099 Zwique Zwique
offset offset arpitjain099 arpitjain099
Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS High
CVE-2026-107215 was published for github.com/xuri/excelize/v2 (Go) Oct 8, 2026
lmonstergg Credited to lmonstergg
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion Moderate
CVE-2026-105749 was published for docling (pip) Oct 7, 2026
fpapaleq Credited to fpapaleq and wittjeff wittjeff wittjeff
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions Moderate
CVE-2026-106114 was published for SixLabors.ImageSharp (NuGet) Oct 7, 2026
MegaManSec Credited to MegaManSec
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database