Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,455
Maven
5,000+
npm
5,000+
NuGet
1,090
pip
5,000+
Pub
13
RubyGems
1,135
Rust
1,509
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

3,853 advisories

Loading
OpenTelemetry Javaagent RMI context propagation allows resource exhaustion Moderate
CVE-2026-54712 was published for io.opentelemetry.javaagent:opentelemetry-javaagent (Maven) Jul 29, 2026
decsecre583 Credited to decsecre583
The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per... High Unreviewed
CVE-2026-58182 was published Jul 29, 2026
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses,... High Unreviewed
CVE-2026-65324 was published Jul 29, 2026
Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing... High Unreviewed
CVE-2026-58151 was published Jul 29, 2026
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function... Moderate Unreviewed
CVE-2026-17501 was published Jul 27, 2026
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7... Moderate Unreviewed
CVE-2026-43768 was published Jul 27, 2026
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0... High Unreviewed
CVE-2026-14981 was published Jul 28, 2026
A logic issue existed resulting in memory corruption. This was addressed with improved state... Moderate Unreviewed
CVE-2026-28932 was published Jul 27, 2026
hermes-agent has an Uncontrolled Resource Consumption issue Moderate
CVE-2026-10224 was published for hermes-agent (pip) Jun 1, 2026
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This... High Unreviewed
CVE-2026-66299 was published Jul 28, 2026
This issue was addressed through improved state management. This issue is fixed in Safari 26.6,... Moderate Unreviewed
CVE-2026-43804 was published Jul 27, 2026
A denial of service issue was addressed by removing the vulnerable code. This issue is fixed in... Moderate Unreviewed
CVE-2026-43806 was published Jul 27, 2026
Addressing certain issues, in particular related to operations which may take excessively long... High Unreviewed
CVE-2026-42493 was published Jul 28, 2026
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding High
CVE-2026-54609 was published for com.quietterminal:qti-neon (Maven) Jul 28, 2026
An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via... High Unreviewed
CVE-2025-63913 was published Jul 28, 2026
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS... Moderate Unreviewed
CVE-2026-64724 was published Jul 27, 2026
Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph... High Unreviewed
CVE-2026-66920 was published Jul 28, 2026
An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE... Moderate Unreviewed
CVE-2026-42006 was published May 12, 2026
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and... Moderate Unreviewed
CVE-2026-43653 was published May 11, 2026
libp2p: yamux connection DoS via oversized data frame High
GHSA-hmj8-5xmh-5573 was published for libp2p (pip) Jul 24, 2026
tahaafarooq Credited to tahaafarooq
Shescape: Quadratic-time denial of service in the flag-protection High
GHSA-gm3r-q2wp-hw87 was published for shescape (npm) Jul 24, 2026
oran-s Credited to oran-s and ericcornelissen ericcornelissen ericcornelissen
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash High
CVE-2026-14257 was published for brace-expansion (npm) Jul 24, 2026
bnbdr Credited to bnbdr
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion High
GHSA-g5vv-q72c-7j78 was published for @anephenix/hub (npm) Jul 24, 2026
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway Critical
GHSA-68r5-9hpg-7qw9 was published for org.openidentityplatform.opendj:opendj-dsml-servlet (Maven) Jul 24, 2026
manus-use Credited to manus-use
It is possible to bypass the maximum number of normalized policy alternatives that was introduced... High Unreviewed
CVE-2026-66143 was published Jul 24, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database