Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

157 advisories

Loading
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in... Moderate Unreviewed
CVE-2026-115503 was published Oct 22, 2026
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in... Moderate Unreviewed
CVE-2026-115396 was published Oct 22, 2026
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated... High Unreviewed
CVE-2026-113873 was published Oct 22, 2026
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS High
CVE-2026-96637 was published for pillow (pip) Oct 22, 2026
sonicnew Credited to sonicnew, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) Moderate
CVE-2026-96636 was published for Pillow (pip) Oct 22, 2026
mohammedix88 Credited to mohammedix88, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox... High Unreviewed
CVE-2026-93471 was published Oct 22, 2026
Pillow: MSP RLE decoder expands a tiny file into unbounded memory High
CVE-2026-112892 was published for pillow (pip) Oct 21, 2026
MegaManSec Credited to MegaManSec, radarhere, and hugovk radarhere radarhere
hugovk hugovk
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML... Moderate Unreviewed
CVE-2026-92823 was published Oct 21, 2026
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all... High Unreviewed
CVE-2026-90797 was published Oct 20, 2026
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated... High Unreviewed
CVE-2026-111924 was published Oct 17, 2026
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... High Unreviewed
CVE-2026-102477 was published Oct 15, 2026
An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd... High Unreviewed
CVE-2026-102072 was published Oct 14, 2026
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's... Moderate Unreviewed
CVE-2026-95502 was published Oct 13, 2026
The network messaging layer contained improper handling of highly compressed data affecting... High Unreviewed
CVE-2026-97334 was published Oct 13, 2026
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media... High Unreviewed
CVE-2026-109324 was published Oct 12, 2026
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the... High Unreviewed
CVE-2026-109398 was published Oct 12, 2026
SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow... High Unreviewed
CVE-2026-109229 was published Oct 12, 2026
SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that... High Unreviewed
CVE-2026-109226 was published Oct 12, 2026
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows... Moderate Unreviewed
CVE-2026-108750 was published Oct 11, 2026
Vikunja: Denial of service via decompression bomb in the data import High
CVE-2026-91979 was published for code.vikunja.io/api (Go) Oct 9, 2026
Str1ckl4nd Credited to Str1ckl4nd, 7thParkk, 0xcelien, and JellowBeanz26 7thParkk 7thParkk
0xcelien 0xcelien JellowBeanz26 JellowBeanz26
CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap.... High Unreviewed
CVE-2026-78384 was published Oct 9, 2026
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting... Moderate Unreviewed
CVE-2026-107335 was published Oct 8, 2026
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled High
CVE-2026-107227 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a security policy bypass in the MAT... Moderate Unreviewed
CVE-2026-105826 was published Oct 8, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database