8000 GitHub Advisory Database · GitHub
[go: up one dir, main page]
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

37,597 advisories

Loading
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection Moderate
CVE-2026-119284 was published for joserfc (pip) Oct 30, 2026
ze3tar Credited to ze3tar
joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption High
CVE-2026-119283 was published for joserfc (pip) Oct 30, 2026
EQSTLab Credited to EQSTLab and useworld useworld useworld
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users Moderate
GHSA-f3fj-9625-rv3m was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99
charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories Moderate
GHSA-fgxm-5hvv-x4vh was published for github.com/charmbracelet/soft-serve (Go) Oct 30, 2026
sondt99 Credited to sondt99 and Xiaoyiyi23 Xiaoyiyi23 Xiaoyiyi23
@nx/maven and @nx/gradle have OS command injection via nx.json plugin options High
CVE-2026-119282 was published for @nx/gradle (npm) Oct 30, 2026
arkmarta Credited to arkmarta
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs High
CVE-2026-118664 was published for decode-uri-component (npm) Oct 29, 2026
gdegrange Credited to gdegrange
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset High
GHSA-vpp8-g58w-m8mp was published for Twisted (pip) Oct 29, 2026
arkmarta Credited to arkmarta
zip: legacy Shrink/Reduce/Implode decoder: denial of service from atta 8000 cker-controlled ZIP64 uncompressed size High
CVE-2026-115907 was published for zip (Rust) Oct 29, 2026
Yeaseen Credited to Yeaseen
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. High
CVE-2026-115908 was published for zip (Rust) Oct 29, 2026
sl91994 Credited to sl91994
zip: AES Entry HMAC Authentication Bypass on Premature EOF Moderate
CVE-2026-115906 was published for zip (Rust) Oct 29, 2026
secstant-sigp Credited to secstant-sigp and Its-Just-Nans Its-Just-Nans Its-Just-Nans
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction High
CVE-2026-115909 was published for zip (Rust) Oct 29, 2026
kirk-baird Credited to kirk-baird, secstant-sigp, and li-jin-quan secstant-sigp secstant-sigp
li-jin-quan li-jin-quan
Vite: `server.fs.deny` bypassed with queries Moderate
CVE-2026-118662 was published for vite (npm) Oct 29, 2026
Hama1cco Credited to Hama1cco
Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps High
CVE-2026-63414 was published for shopify_app (RubyGems) Oct 29, 2026
cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials High
CVE-2026-62290 was published for github.com/cert-manager/cert-manager (Go) Oct 29, 2026
kamil-sawicki Credited to kamil-sawicki, robertprast, and EQSTLab robertprast robertprast
EQSTLab EQSTLab
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass High
CVE-2026-9086 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing Moderate
CVE-2026-9083 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak allows unauthorized access to resources via uma permission ticket bypass Moderate
CVE-2026-9799 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak vulnerable to authorization bypass via incorrect uri comparison High
CVE-2026-9800 was published for org.keycloak:keycloak-policy-enforcer (Maven) Oct 29, 2026
Keycloak: Attacker can re-enable and take over disabled clients via registration access token Moderate
CVE-2026-9705 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy High
GHSA-w9x9-j56r-h98r was published for @eeacms/volto-chatbot (npm) Oct 29, 2026
EQSTLab Credited to EQSTLab
Crass: Non-ASCII characters cause superlinear CPU consumption Moderate
CVE-2026-61848 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Crass: A large number of adjacent CSS comments can trigger a SystemStackError Moderate
CVE-2026-61847 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage Moderate
CVE-2026-61846 was published for crass (RubyGems) Oct 29, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence Low
GHSA-c33x-vcv4-vg3g was published for @cedar-policy/cedar-wasm (npm) Oct 29, 2026
john-h-kastner-aws Credited to john-h-kastner-aws and DenizParlak DenizParlak DenizParlak
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY High
CVE-2026-62264 was published for @sylphx/pdf-reader-mcp (npm) Oct 29, 2026
novice-22 Credited to novice-22
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database
0