Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,600
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

36,937 advisories

Loading
aiohttp server lacks an initial request/header timeout High
CVE-2026-111064 was published for aiohttp (pip) Oct 19, 2026
tatulea Credited to tatulea and Dreamsorcerer Dreamsorcerer Dreamsorcerer
AIOHTTP: Secure attribute not enforced for shared cookie Low
CVE-2026-111063 was published for aiohttp (pip) Oct 19, 2026
euriconicacio Credited to euriconicacio and Dreamsorcerer Dreamsorcerer Dreamsorcerer
aiohttp: Multiple instances of excessive or unbounded memory/CPU use High
GHSA-2g87-pp6c-29x5 was published for aiohttp (pip) Oct 19, 2026
alimony Credited to alimony, EpicLiem, axel-mierczuk-1pw, afldl, iamibi, denyspakizh-tob, rodrigobnogueira, and Dreamsorcerer EpicLiem EpicLiem
axel-mierczuk-1pw axel-mierczuk-1pw afldl afldl iamibi iamibi denyspakizh-tob denyspakizh-tob rodrigobnogueira rodrigobnogueira Dreamsorcerer Dreamsorcerer
russh: Unbounded memory allocation in agent protocol server via crafted constraint records Moderate
CVE-2026-111061 was published for russh (Rust) Oct 19, 2026
Tan-JunWei Credited to Tan-JunWei
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request Low
CVE-2026-111062 was published for russh (Rust) Oct 19, 2026
Eric-D Credited to Eric-D
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML Moderate
CVE-2026-111059 was published for mercury (pip) Oct 19, 2026
yuuto200511-hash Credited to yuuto200511-hash
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass Critical
CVE-2026-111057 was published for mercury (pip) Oct 19, 2026
szotgan Credited to szotgan
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable Moderate
GHSA-953h-535j-jg2v was published for github.com/envoyproxy/ai-gateway (Go) Oct 19, 2026
aeonframework Credited to aeonframework, nacx, PraveenKumarInjam, and kanywst nacx nacx
PraveenKumarInjam PraveenKumarInjam kanywst kanywst
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo Moderate
GHSA-pcc4-rvhr-2pr8 was published for graphifyy (pip) Oct 19, 2026
aeonframework Credited to aeonframework
Mercury: Unauthenticated Remote Code Execution via /api/kernels Critical
CVE-2026-111058 was published for mercury (pip) Oct 19, 2026
CyberKareem Credited to CyberKareem
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files High
CVE-2026-108372 was published for loopx (pip) Oct 19, 2026
aeonframework Credited to aeonframework
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check) High
CVE-2026-96627 was published for github.com/getarcaneapp/arcane/backend/v2 (Go) Oct 16, 2026
manus-use Credited to manus-use
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof` Moderate
CVE-2026-96628 was published for github.com/getarcaneapp/arcane/backend/v2 (Go) Oct 16, 2026
gehan-psbc Credited to gehan-psbc
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport Critical
CVE-2026-105192 was published for lmcache (pip) Oct 16, 2026
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content High
CVE-2026-100349 was published for github.com/getkin/kin-openapi (Go) Oct 16, 2026
vnykmshr Credited to vnykmshr
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination Moderate
CVE-2026-58494 was published for wasmtime-wasi (Rust) Oct 16, 2026
sdjasj Credited to sdjasj
lopdf has a stack overflow via deeply nested PDF objects High
GHSA-6fj4-rcr3-r7rr was published for lopdf (Rust) Oct 16, 2026
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS High
CVE-2026-102834 was published for org.bytedeco:javacv (Maven) Oct 16, 2026
tinyb0y Credited to tinyb0y
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution Critical
CVE-2026-96620 was published for claude-agent-sdk (pip) Oct 16, 2026
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin Low
CVE-2026-62994 was published for github.com/coredns/coredns (Go) Oct 16, 2026
sondt99 Credited to sondt99
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) Low
CVE-2026-76894 was published for @aborruso/ckan-mcp-server (npm) Oct 16, 2026
Gal3m Credited to Gal3m and mrostamipoor mrostamipoor mrostamipoor
swoosh has email-derived URL path injection in Microsoft Graph endpoint Low
CVE-2026-54893 was published for swoosh (Erlang) Oct 16, 2026
PJUllrich Credited to PJUllrich, maennchen, and princemaple maennchen maennchen
princemaple princemaple
ClickMigrate has Path Traversal in "revision -m" argument Low
CVE-2026-68549 was published for ClickMigrate (pip) Oct 16, 2026
gomarkdown/markdown IsSafeURL panics on short URLs High
CVE-2026-102941 was published for github.com/gomarkdown/markdown (Go) Oct 16, 2026
arpitjain099 Credited to arpitjain099
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses Critical
CVE-2026-102989 was published for @tanstack/react-start (npm) Oct 15, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database