8000 GitHub Advisory Database · GitHub
[go: up one dir, main page]
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

37,597 advisories

Loading
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server Low
CVE-2026-115917 was published for vllm (pip) Oct 28, 2026
prnjlksingh Credited to prnjlksingh and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine Moderate
CVE-2026-115913 was published for vllm (pip) Oct 28, 2026
C1ves Credited to C1ves and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM DeepSeek-OCR image processing vulnerable to denial of service Moderate
CVE-2026-115914 was published for vllm (pip) Oct 28, 2026
C1ves Credited to C1ves, jperezdealgaba, and JSGforever jperezdealgaba jperezdealgaba
JSGforever JSGforever
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE High
CVE-2026-115915 was published for vllm (pip) Oct 28, 2026
LittlehamsterXu Credited to LittlehamsterXu and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled High
CVE-2026-115912 was published for vllm (pip) Oct 28, 2026
KernelClint Credited to KernelClint, DarkLight1337, and jperezdealgaba DarkLight1337 DarkLight1337
jperezdealgaba jperezdealgaba
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) Moderate
CVE-2026-115916 was published 8000 for vllm (pip) Oct 28, 2026
shijie-lyu Credited to shijie-lyu and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs Moderate
CVE-2026-115918 was published for vllm (pip) Oct 28, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool Moderate
CVE-2026-115911 was published for vllm (pip) Oct 28, 2026
oran-s Credited to oran-s and jperezdealgaba jperezdealgaba jperezdealgaba
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction Critical
CVE-2026-115893 was published for wasmtime (Rust) Oct 28, 2026
ilyas-mallah Credited to ilyas-mallah
Go JOSE: Panics in JSON parsing Moderate
CVE-2026-116586 was published for github.com/go-jose/go-jose/v3 (Go) Oct 28, 2026
Go JOSE: Panic during CBC-HMAC processing Moderate
CVE-2026-116585 was published for github.com/go-jose/go-jose/v3 (Go) Oct 28, 2026
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net Low
CVE-2026-116673 was published for systeminformation (npm) Oct 28, 2026
itsFM-Codes Credited to itsFM-Codes
systeminformation has prototype pollution in `networkStats()` via the interface name Moderate
CVE-2026-116674 was published for systeminformation (npm) Oct 28, 2026
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output Moderate
CVE-2026-115885 was published for langgraph-cli (pip) Oct 28, 2026
C0KERNEL Credited to C0KERNEL
graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service High
CVE-2026-115887 was published for graphql-scalars (npm) Oct 28, 2026
pozylon Credited to pozylon, dotansimha, enisdenjo, Pteam-sa, and otavlna dotansimha dotansimha
enisdenjo enisdenjo Pteam-sa Pteam-sa otavlna otavlna
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) Moderate
CVE-2026-116579 was published for autobahn (pip) Oct 28, 2026
adriank31 Credited to adriank31
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string Low
CVE-2026-118258 was published for i18next-http-backend (npm) Oct 28, 2026
adriank31 Credited to adriank31
RE2JS: Quadratic-time denial of service in re2js lookbehind matching High
CVE-2026-116795 was published for re2js (npm) Oct 28, 2026
Nois3 Credited to Nois3
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE Critical
CVE-2026-115905 was published for zip (Rust) Oct 28, 2026
ByGh00st Credited to ByGh00st and Pr0methean Pr0methean Pr0methean
LangGraph JavaScript custom authentication may permit cross-user Store access High
CVE-2026-118668 was published for langgraph-api (pip) Oct 28, 2026
coinspect-audits Credited to coinspect-audits
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock Low
CVE-2026-112941 was published for filelock (pip) Oct 28, 2026
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold Moderate
CVE-2026-112908 was published for filelock (pip) Oct 28, 2026
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion Moderate
CVE-2026-112911 was published for filelock (pip) Oct 28, 2026
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL Moderate
CVE-2026-112910 was published for filelock (pip) Oct 28, 2026
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout Moderate
CVE-2026-112915 was published for filelock (pip) Oct 28, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database
0