Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,600
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

36,943 advisories

Loading
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) High
CVE-2026-111752 was published for @angular/router (npm) Oct 20, 2026
SkyZeroZx Credited to SkyZeroZx, atscott, and alan-agius4 atscott atscott
alan-agius4 alan-agius4
Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths Moderate
CVE-2026-111757 was published for hono (npm) Oct 20, 2026
manop55555 Credited to manop55555
@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR) Moderate
CVE-2026-111754 was published for @angular/platform-server (npm) Oct 20, 2026
SkyZeroZx Credited to SkyZeroZx, alan-agius4, and JeanMeche alan-agius4 alan-agius4
JeanMeche JeanMeche
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes High
CVE-2026-111759 was published for markdown-it (npm) Oct 20, 2026
GSGFs7 Credited to GSGFs7
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress High
CVE-2026-63209 was published for github.com/klauspost/compress (Go) Oct 20, 2026
celinke97 Credited to celinke97
Crass : Large numeric exponents cause CPU and memory denial of service High
CVE-2026-61845 was published for crass (RubyGems) Oct 20, 2026
hourianto Credited to hourianto and rgrove rgrove rgrove
aiohttp server lacks an initial request/header timeout High
CVE-2026-111064 was published for aiohttp (pip) Oct 19, 2026
tatulea Credited to tatulea and Dreamsorcerer Dreamsorcerer Dreamsorcerer
AIOHTTP: Secure attribute not enforced for shared cookie Low
CVE-2026-111063 was published for aiohttp (pip) Oct 19, 2026
euriconicacio Credited to euriconicacio and Dreamsorcerer Dreamsorcerer Dreamsorcerer
aiohttp: Multiple instances of excessive or unbounded memory/CPU use High
GHSA-2g87-pp6c-29x5 was published for aiohttp (pip) Oct 19, 2026
alimony Credited to alimony, EpicLiem, axel-mierczuk-1pw, afldl, iamibi, denyspakizh-tob, rodrigobnogueira, and Dreamsorcerer EpicLiem EpicLiem
axel-mierczuk-1pw axel-mierczuk-1pw afldl afldl iamibi iamibi denyspakizh-tob denyspakizh-tob rodrigobnogueira rodrigobnogueira Dreamsorcerer Dreamsorcerer
russh: Unbounded memory allocation in agent protocol server via crafted constraint records Moderate
CVE-2026-111061 was published for russh (Rust) Oct 19, 2026
Tan-JunWei Credited to Tan-JunWei
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request Low
CVE-2026-111062 was published for russh (Rust) Oct 19, 2026
Eric-D Credited to Eric-D
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML Moderate
CVE-2026-111059 was published for mercury (pip) Oct 19, 2026
yuuto200511-hash Credited to yuuto200511-hash
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass Critical
CVE-2026-111057 was published for mercury (pip) Oct 19, 2026
szotgan Credited to szotgan
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable Moderate
GHSA-953h-535j-jg2v was published for github.com/envoyproxy/ai-gateway (Go) Oct 19, 2026
aeonframework Credited to aeonframework, nacx, PraveenKumarInjam, and kanywst nacx nacx
PraveenKumarInjam PraveenKumarInjam kanywst kanywst
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo Moderate
GHSA-pcc4-rvhr-2pr8 was published for graphifyy (pip) Oct 19, 2026
aeonframework Credited to aeonframework
Mercury: Unauthenticated Remote Code Execution via /api/kernels Critical
CVE-2026-111058 was published for mercury (pip) Oct 19, 2026
CyberKareem Credited to CyberKareem
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files High
CVE-2026-108372 was published for loopx (pip) Oct 19, 2026
aeonframework Credited to aeonframework
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) High
CVE-2026-96627 was published for github.com/getarcaneapp/arcane/backend/v2 (Go) Oct 16, 2026
manus-use Credited to manus-use
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` Moderate
CVE-2026-96628 was published for github.com/getarcaneapp/arcane/backend/v2 (Go) Oct 16, 2026
gehan-psbc Credited to gehan-psbc
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport Critical
CVE-2026-105192 was published for lmcache (pip) Oct 16, 2026
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content High
CVE-2026-100349 was published for github.com/getkin/kin-openapi (Go) Oct 16, 2026
vnykmshr Credited to vnykmshr
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination Moderate
CVE-2026-58494 was published for wasmtime-wasi (Rust) Oct 16, 2026
sdjasj Credited to sdjasj
lopdf has a stack overflow via deeply nested PDF objects High
GHSA-6fj4-rcr3-r7rr was published for lopdf (Rust) Oct 16, 2026
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS High
CVE-2026-102834 was published for org.bytedeco:javacv (Maven) Oct 16, 2026
tinyb0y Credited to tinyb0y
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database