Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

37,118 advisories

Loading
virtualenv: Generated files can follow existing destination links Moderate
CVE-2026-113721 was published for virtualenv (pip) Oct 22, 2026
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() High
GHSA-78g4-xqwv-q3g8 was published for pillow (pip) Oct 22, 2026
thesecguy45 Credited to thesecguy45
Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive Moderate
CVE-2026-114132 was published for @nuxt/nitro-server (npm) Oct 22, 2026
Aeg1sx Credited to Aeg1sx, viralvaghela, and jkrshnmenon viralvaghela viralvaghela
jkrshnmenon jkrshnmenon
Nuxt server islands render `useHeadSafe` input without sanitisation Moderate
CVE-2026-114133 was published for nuxt (npm) Oct 22, 2026
kq5y Credited to kq5y
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled Low
CVE-2026-114130 was published for nuxt (npm) Oct 22, 2026
4drez Credited to 4drez
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes Moderate
CVE-2026-114131 was published for nuxt (npm) Oct 22, 2026
sushi-gif Credited to sushi-gif
pypdf: Possible long runtimes/large memory usage when retrieving form fields Moderate
CVE-2026-113789 was published for pypdf (pip) Oct 22, 2026
adriank31 Credited to adriank31 and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible large memory usage when parsing arrays and dictionaries Moderate
CVE-2026-113790 was published for pypdf (pip) Oct 22, 2026
26627 Credited to 26627 and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible large memory usage when parsing content streams Moderate
CVE-2026-113791 was published for pypdf (pip) Oct 22, 2026
scanleale Credited to scanleale and stefan6419846 stefan6419846 stefan6419846
Electron: SameSite cookie restrictions are not applied to windows opened from links Moderate
CVE-2026-113796 was published for electron (npm) Oct 22, 2026
mingijunggrape Credited to mingijunggrape
Electron: Pointer lock permission requests can be attributed to the wrong frame Moderate
CVE-2026-113798 was published for electron (npm) Oct 22, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission Low
CVE-2026-113797 was published for electron (npm) Oct 22, 2026
Electron: Frame subscription trusts GPU-supplied frame geometry Low
CVE-2026-114122 was published for electron (npm) Oct 22, 2026
manus-pi Credited to manus-pi
Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry Low
CVE-2026-114124 was published for electron (npm) Oct 22, 2026
manus-pi Credited to manus-pi
Electron: openExternal permission requests can be attributed to the wrong origin Moderate
CVE-2026-114121 was published for electron (npm) Oct 22, 2026
scofaild23 Credited to scofaild23
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays Critical
GHSA-673q-mjm6-r5xr was published for next (npm) Oct 22, 2026
evolutionstorm Credited to evolutionstorm
GitPython validates a submodule's ".git" path only after cloning into it (RCE) High
CVE-2026-114145 was published for Gitpython (pip) Oct 22, 2026
H1tr30xNull Credited to H1tr30xNull
fastify is vulnerable to header validation bypass via case-sensitive propertyNames Low
CVE-2026-107832 was published for fastify (npm) Oct 22, 2026
uttej-badwane Credited to uttej-badwane, mcollina, UlisesGascon, and kian0417 mcollina mcollina
UlisesGascon UlisesGascon kian0417 kian0417
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype High
CVE-2026-114142 was published for tome (npm) Oct 22, 2026
b1ue0ceanRun Credited to b1ue0ceanRun
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() High
CVE-2026-114141 was published for toml (npm) Oct 22, 2026
pi3ch Credited to pi3ch
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() High
CVE-2026-114143 was published for toml (npm) Oct 22, 2026
pi3ch Credited to pi3ch, midnightmichigan, manus-pi, and devzephyr midnightmichigan midnightmichigan
manus-pi manus-pi devzephyr devzephyr
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() High
CVE-2026-114144 was published for toml (npm) Oct 22, 2026
Zywexx Credited to Zywexx
Storybook dev server vulnerable to code injection from the local network High
CVE-2026-114126 was published for @storybook/addon-mcp (npm) Oct 22, 2026
KimiSecurityTeam Credited to KimiSecurityTeam, christos-cantina-security, Sidnioulz, and ghengeveld christos-cantina-security christos-cantina-security
Sidnioulz Sidnioulz ghengeveld ghengeveld
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering Moderate
CVE-2026-114128 was published for astro (npm) Oct 22, 2026
RKasai127 Credited to RKasai127
Astro: Arbitrary CSS injection in Astro View Transitions Low
CVE-2026-114127 was published for astro (npm) Oct 22, 2026
avrlab233 Credited to avrlab233
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database