Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

13,471 advisories

Loading
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load() High
GHSA-78g4-xqwv-q3g8 was published for pillow (pip) Oct 22, 2026
thesecguy45 Credited to thesecguy45
GitPython validates a submodule's ".git" path only after cloning into it (RCE) High
CVE-2026-114145 was published for Gitpython (pip) Oct 22, 2026
H1tr30xNull Credited to H1tr30xNull
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype High
CVE-2026-114142 was published for tome (npm) Oct 22, 2026
b1ue0ceanRun Credited to b1ue0ceanRun
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() High
CVE-2026-114141 was published for toml (npm) Oct 22, 2026
pi3ch Credited to pi3ch
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() High
CVE-2026-114143 was published for toml (npm) Oct 22, 2026
pi3ch Credited to pi3ch, midnightmichigan, manus-pi, and devzephyr midnightmichigan midnightmichigan
manus-pi manus-pi devzephyr devzephyr
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() High
CVE-2026-114144 was published for toml (npm) Oct 22, 2026
Zywexx Credited to Zywexx
Storybook dev server vulnerable to code injection from the local network High
CVE-2026-114126 was published for @storybook/addon-mcp (npm) Oct 22, 2026
KimiSecurityTeam Credited to KimiSecurityTeam, christos-cantina-security, Sidnioulz, and ghengeveld christos-cantina-security christos-cantina-security
Sidnioulz Sidnioulz ghengeveld ghengeveld
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments High
CVE-2026-114604 was published for @graphql-tools/utils (npm) Oct 22, 2026
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit High
CVE-2026-75508 was published for graphql-core (pip) Oct 22, 2026
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule High
CVE-2026-75507 was published for graphql-core (pip) Oct 22, 2026
bcmyguest Credited to bcmyguest
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p) High
GHSA-mrv2-3pqr-j5jr was published for dompurify (npm) Oct 22, 2026
uttej-badwane Credited to uttej-badwane
nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc High
CVE-2026-114140 was published for nbconvert (pip) Oct 22, 2026
Yann-P Credited to Yann-P, y011d4, HOHK0923, toannguyen3107, NovaHunter06, mohammedix88, and martinRenou y011d4 y011d4
HOHK0923 HOHK0923 toannguyen3107 toannguyen3107 NovaHunter06 NovaHunter06 mohammedix88 mohammedix88 martinRenou martinRenou
Black: GitHub Action installs unvalidated required-version from pyproject.toml High
CVE-2026-114134 was published for black (pip) Oct 22, 2026
jiteshgulati Credited to jiteshgulati
Django REST framework: TokenProxy.delete() reports success and revokes nothing High
CVE-2026-114137 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation High
CVE-2026-114138 was published for djangorestframework (pip) Oct 22, 2026
jisung-02 Credited to jisung-02
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
Duplicate Advisory: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing High
GHSA-wxxx-r42m-9rp8 was published for nodemailer (npm) Oct 15, 2026 • withdrawn
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer High
CVE-2026-96778 was published for Pillow (pip) Oct 22, 2026
carlini Credited to carlini
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds) High
CVE-2026-96644 was published for Pillow (pip) Oct 22, 2026
MegaManSec Credited to MegaManSec
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time High
CVE-2026-96643 was published for Pillow (pip) Oct 22, 2026
0xSmiley Credited to 0xSmiley and radarhere radarhere radarhere
Pillow: TarIO negative size field causes infinite CPU-spin loop High
CVE-2026-96642 was published for Pillow (pip) Oct 22, 2026
0xSmiley Credited to 0xSmiley and radarhere radarhere radarhere
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion High
CVE-2026-96640 was published for Pillow (pip) Oct 22, 2026
mfazrinizar Credited to mfazrinizar
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS High
CVE-2026-96637 was published for pillow (pip) Oct 22, 2026
sonicnew Credited to sonicnew, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Librsvg: Use-after-free when XML includes have duplicated entities High
CVE-2026-96889 was published for librsvg (Rust) Oct 22, 2026
Next.js: Denial of Service in App Router using Server Actions High
CVE-2026-94482 was published for next (npm) Oct 22, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database