8000 GitHub Advisory Database · GitHub
[go: up one dir, main page]
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

37,597 advisories

Loading
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox High
CVE-2026-61438 was published for praisonai (pip) Oct 29, 2026
chakrapani150 Credited to chakrapani150
Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist Low
CVE-2026-61448 was published for parse-server (npm) Oct 29, 2026
CyberKareem Credited to CyberKareem and mtrezza mtrezza mtrezza
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware High
CVE-2026-62160 was published for github.com/daptin/daptin (Go) Oct 29, 2026
tonghuaroot Credited to tonghuaroot
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets Low
GHSA-pg53-p7qp-65cv was published for pocketmine/pocketmine-mp (Composer) Oct 29, 2026
Genesizs Credited to Genesizs and dktapps dktapps dktapps
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow Moderate
CVE-2026-55186 was published for silverstripe/mfa (Composer) Oct 29, 2026
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks Moderate
CVE-2026-115927 was published for tornado (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane
Tornado: Open redirect in RedirectHandler via protocol-relative URLs Low
CVE-2026-116578 was published for tornado (pip) Oct 28, 2026
gn00295120 Credited to gn00295120
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Moderate
CVE-2026-116577 was published for tornado (pip) Oct 28, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass Moderate
CVE-2026-116695 was published for crass (RubyGems) Oct 28, 2026
Pig-Tail Credited to Pig-Tail and rgrove rgrove rgrove
systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks High
CVE-2026-116576 was published for systeminformation (npm) Oct 28, 2026
itsFM-Codes Credited to itsFM-Codes
Backstage catalog rules can be bypassed for URL locations using encoded path segments Moderate
CVE-2026-115923 was published for @backstage/plugin-catalog-backend (npm) Oct 28, 2026
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it Critical
CVE-2026-117601 was published for electrum (pip) Oct 28, 2026
Raju-K12 Credited to Raju-K12
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion Moderate
GHSA-2hw4-c9m4-f2fj was published for knative.dev/pkg (Go) Oct 28, 2026
tonghuaroot Credited to tonghuaroot
Waline login accepts a non-string email as a match-all MongoDB query Moderate
GHSA-jf75-q64q-g65r was published for @waline/vercel (npm) Oct 28, 2026
dizconnectz Credited to dizconnectz
Seroval: Code injection through a typed array's own constructor property Moderate
CVE-2026-116583 was published for seroval (npm) Oct 28, 2026
Seroval: Script injection through RegExp sources in serialized output Moderate
CVE-2026-116582 was published for seroval (npm) Oct 28, 2026
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) High
CVE-2026-116581 was published for seroval (npm) Oct 28, 2026
realies Credited to realies
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length High
CVE-2026-116584 was published for seroval (npm) Oct 28, 2026
llegomark Credited to llegomark
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check High
CVE-2026-116580 was published for seroval (npm) Oct 28, 2026
cruzryan Credited to cruzryan
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope) Moderate
CVE-2026-116575 was published for mem0ai (npm) Oct 28, 2026
OfficialAbhinavSingh Credited to OfficialAbhinavSingh
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim Moderate
CVE-2026-115910 was published for social-auth-core (pip) Oct 28, 2026
uttej-badwane Credited to uttej-badwane and nijel nijel nijel
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank Moderate
CVE-2026-115920 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs Moderate
CVE-2026-115922 was published for onnx (pip) Oct 28, 2026
Zwique Credited to Zwique
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute Moderate
CVE-2026-115921 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) Moderate
CVE-2026-115919 was published for onnx (pip) Oct 28, 2026
MinicoAI Credited to MinicoAI
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database
0