Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

7,193 advisories

Loading
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies Moderate
CVE-2026-113730 was published for ognl:ognl (Maven) Oct 21, 2026
garymao Credited to garymao
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure Moderate
CVE-2026-111762 was published for org.a2aproject.sdk:a2a-java-sdk-transport-rest (Maven) Oct 20, 2026
ehsavoie Credited to ehsavoie
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix High
CVE-2026-111765 was published for org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven) Oct 20, 2026
north-echo Credited to north-echo
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery Moderate
CVE-2026-111761 was published for org.a2aproject.sdk:a2a-java-sdk-server-common (Maven) Oct 20, 2026
asishinfosec Credited to asishinfosec
A2A Java SDK has a fail-open default task authorization High
CVE-2026-111764 was published for org.a2aproject.sdk:a2a-java-sdk-server-common (Maven) Oct 20, 2026
asishinfosec Credited to asishinfosec
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect Moderate
CVE-2026-111763 was published for org.a2aproject.sdk:a2a-java-sdk-parent (Maven) Oct 20, 2026
ehsavoie Credited to ehsavoie
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS High
CVE-2026-102834 was published for org.bytedeco:javacv (Maven) Oct 16, 2026
tinyb0y Credited to tinyb0y
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction High
CVE-2026-97370 was published for com.github.junrar:junrar (Maven) Oct 15, 2026
dds921 Credited to dds921 and KeenSecurityLab KeenSecurityLab KeenSecurityLab
Hazelcast allows arbitrary member memory access by low-privileged client Critical
CVE-2026-107726 was published for com.hazelcast:hazelcast (Maven) Oct 8, 2026
k-jamroz Credited to k-jamroz
Hazelcast has an authorization bypass in IMap Predicates API High
CVE-2026-107725 was published for com.hazelcast:hazelcast (Maven) Oct 8, 2026
k-jamroz Credited to k-jamroz
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) Moderate
CVE-2026-107228 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
1diot9 Credited to 1diot9
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS Moderate
CVE-2026-107226 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled High
CVE-2026-107227 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins High
CVE-2026-107230 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source Low
CVE-2026-107283 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel Moderate
CVE-2026-107285 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk Moderate
CVE-2026-107280 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host Critical
CVE-2026-107282 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext High
CVE-2026-107231 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS Moderate
CVE-2026-106121 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
NotAFlightRisk Credited to NotAFlightRisk
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user High
CVE-2026-106451 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError Low
CVE-2026-106449 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs Moderate
CVE-2026-106450 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers Moderate
CVE-2026-106122 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
ba-am Credited to ba-am
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() Moderate
CVE-2026-106123 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
sonicnew Credited to sonicnew, mark-adams, HonorableSudoku, and xnuinside mark-adams mark-adams
HonorableSudoku HonorableSudoku xnuinside xnuinside
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database