Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

37,118 advisories

Loading
pypdf: Possible infinite loop when removing tree items Moderate
CVE-2026-113793 was published for pypdf (pip) Oct 21, 2026
manus-pi Credited to manus-pi and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible infinite loop when hitting EOF in standard xref table Moderate
CVE-2026-113794 was published for pypdf (pip) Oct 21, 2026
stefan6419846 Credited to stefan6419846
virtualenv bash activate runs commands from an environment name with a backslash before $ High
CVE-2026-113725 was published for virtualenv (pip) Oct 21, 2026
gaborbernat Credited to gaborbernat
pypdf: Possible large memory usage for streams with multiple filters Moderate
CVE-2026-113795 was published for pypdf (pip) Oct 21, 2026
priyankn Credited to priyankn and stefan6419846 stefan6419846 stefan6419846
Vite: Cross origin script execution through Vite custom middleware Low
CVE-2026-112945 was published for vite (npm) Oct 21, 2026
deevashwer Credited to deevashwer and bluwy bluwy bluwy
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine Moderate
CVE-2026-112946 was published for vite (npm) Oct 21, 2026
Kushalkhemka Credited to Kushalkhemka, bluwy, mayank-jangid-moon, skigeek16, and opensec-intelligence bluwy bluwy
mayank-jangid-moon mayank-jangid-moon skigeek16 skigeek16 opensec-intelligence opensec-intelligence
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` Moderate
CVE-2026-112947 was published for vite (npm) Oct 21, 2026
zer0d4y5 Credited to zer0d4y5 and bluwy bluwy bluwy
virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST High
CVE-2026-113726 was published for virtualenv (pip) Oct 21, 2026
kemrec Credited to kemrec and gaborbernat gaborbernat gaborbernat
virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote High
CVE-2026-113732 was published for virtualenv (pip) Oct 21, 2026
Kwstubbs Credited to Kwstubbs and gaborbernat gaborbernat gaborbernat
virtualenv activation scripts run code from a path that contains a placeholder name High
CVE-2026-113776 was published for virtualenv (pip) Oct 21, 2026
Kwstubbs Credited to Kwstubbs and gaborbernat gaborbernat gaborbernat
Slack Morphism verifier errors disclose valid HMACs in the logs Moderate
CVE-2026-113799 was published for slack-morphism (Rust) Oct 21, 2026
Ridful Credited to Ridful
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies Moderate
CVE-2026-113730 was published for ognl:ognl (Maven) Oct 21, 2026
garymao Credited to garymao
OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs High
CVE-2026-113727 was published for github.com/openchoreo/openchoreo (Go) Oct 21, 2026
Tike00 Credited to Tike00
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization High
CVE-2026-113729 was published for github.com/moov-io/signedxml (Go) Oct 21, 2026
shuji-oh Credited to shuji-oh
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export High
CVE-2026-113711 was published for @apostrophecms/import-export (npm) Oct 21, 2026
kaizhi888 Credited to kaizhi888 and bp0lr bp0lr bp0lr
Cachet has Stored XSS in Incident Component Moderate
CVE-2026-113712 was published for cachethq/cachet (Composer) Oct 20, 2026
MAVERICK-VF142 Credited to MAVERICK-VF142
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure Moderate
CVE-2026-111762 was published for org.a2aproject.sdk:a2a-java-sdk-transport-rest (Maven) Oct 20, 2026
ehsavoie Credited to ehsavoie
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix High
CVE-2026-111765 was published for org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven) Oct 20, 2026
north-echo Credited to north-echo
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery Moderate
CVE-2026-111761 was published for org.a2aproject.sdk:a2a-java-sdk-server-common (Maven) Oct 20, 2026
asishinfosec Credited to asishinfosec
A2A Java SDK has a fail-open default task authorization High
CVE-2026-111764 was published for org.a2aproject.sdk:a2a-java-sdk-server-common (Maven) Oct 20, 2026
asishinfosec Credited to asishinfosec
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect Moderate
CVE-2026-111763 was published for org.a2aproject.sdk:a2a-java-sdk-parent (Maven) Oct 20, 2026
ehsavoie Credited to ehsavoie
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image High
CVE-2026-112397 was published for Pillow (pip) Oct 20, 2026
MegaManSec Credited to MegaManSec, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS High
CVE-2026-112400 was published for Pillow (pip) Oct 20, 2026
Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit Moderate
CVE-2026-112899 was published for Pillow (pip) Oct 20, 2026
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips High
CVE-2026-112897 was published for Pillow (pip) Oct 20, 2026
carlini Credited to carlini
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database