Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,601
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

37,058 advisories

Loading
virtualenv: Builtin creation follows linked environment directories Moderate
CVE-2026-113716 was published for virtualenv (pip) Oct 21, 2026
virtualenv: Deletion recovery can change a symlink target's mode Moderate
CVE-2026-113724 was published for virtualenv (pip) Oct 21, 2026
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax High
CVE-2026-113722 was published for virtualenv (pip) Oct 21, 2026
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags High
CVE-2026-112902 was published for Pillow (pip) Oct 21, 2026
carlini Credited to carlini
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO Critical
CVE-2026-112393 was published for Pillow (pip) Oct 21, 2026
carlini Credited to carlini and Tomer-PL Tomer-PL Tomer-PL
Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer Moderate
CVE-2026-112396 was published for pillow (pip) Oct 21, 2026
MegaManSec Credited to MegaManSec
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle High
CVE-2026-112406 was published for Pillow (pip) Oct 21, 2026
Pillow: APNG background disposal allocates full canvas before decompression bomb check High
CVE-2026-112399 was published for Pillow (pip) Oct 21, 2026
Pillow: MSP RLE decoder expands a tiny file into unbounded memory High
CVE-2026-112892 was published for pillow (pip) Oct 21, 2026
MegaManSec Credited to MegaManSec, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) High
CVE-2026-112894 was published for Pillow (pip) Oct 21, 2026
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree() Moderate
CVE-2026-112391 was published for Pillow (pip) Oct 21, 2026
0xSmiley Credited to 0xSmiley
Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes Moderate
CVE-2026-112901 was published for Pillow (pip) Oct 21, 2026
radarhere Credited to radarhere and hugovk hugovk hugovk
Pillow: Image.quantize() with empty palette leaks uninitialized stack memory Moderate
CVE-2026-112898 was published for Pillow (pip) Oct 21, 2026
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() Moderate
CVE-2026-112401 was published for Pillow (pip) Oct 21, 2026
Pillow: Infinite loop in MIC n_frames when the embedded TIFF High
CVE-2026-112390 was published for Pillow (pip) Oct 21, 2026
Pillow: Quadratic GIF comment copying during save Moderate
CVE-2026-112891 was published for pillow (pip) Oct 21, 2026
iamibi Credited to iamibi
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images High
CVE-2026-112392 was published for Pillow (pip) Oct 21, 2026
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0 High
CVE-2026-112405 was published for pillow (pip) Oct 21, 2026
MegaManSec Credited to MegaManSec, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Pillow: Invalid free in FreeType glyph rendering when a stroker is active High
CVE-2026-112893 was published for pillow (pip) Oct 21, 2026
MegaManSec Credited to MegaManSec, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform High
CVE-2026-112402 was published for Pillow (pip) Oct 21, 2026
Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size Moderate
CVE-2026-112394 was published for Pillow (pip) Oct 21, 2026
akx Credited to akx
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Critical
CVE-2026-112900 was published for Pillow (pip) Oct 21, 2026
HLe4s-kaist Credited to HLe4s-kaist, radarhere, and hugovk radarhere radarhere
hugovk hugovk
pypdf: Unvalidated JPEG image data loading Low
CVE-2026-113786 was published for pypdf (pip) Oct 21, 2026
Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file Moderate
CVE-2026-112948 was published for @vitest/browser (npm) Oct 21, 2026
sondt99 Credited to sondt99, tikket1, and tomohiro86 tikket1 tikket1
tomohiro86 tomohiro86
Vitest: Code injection via unauthenticated manual mock registration Moderate
CVE-2026-112949 was published for @vitest/mocker (npm) Oct 21, 2026
sondt99 Credited to sondt99
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database