Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,192
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,590
Rust
22

37,604 advisories

Loading
Nuxt dev server exposes private runtime config through the Nitro dev bundle Moderate
CVE-2026-119199 was published for @nuxt/vite-builder (npm) Oct 30, 2026
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location High
CVE-2026-118763 was published for @sigstore/oci (npm) Oct 30, 2026
arpitjain099 Credited to arpitjain099
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets Moderate
CVE-2026-119276 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths Moderate
CVE-2026-119279 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths Low
CVE-2026-119280 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files Moderate
CVE-2026-119210 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
buxu Credited to buxu
MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing Moderate
CVE-2026-119281 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects High
CVE-2026-116689 was published for follow-redirects (npm) Oct 30, 2026
burythevalley Credited to burythevalley
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation High
CVE-2026-116794 was published for russh (Rust) Oct 30, 2026
cataggar Credited to cataggar
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) Low
CVE-2026-116775 was published for pageant (Rust) Oct 30, 2026
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) Moderate
CVE-2026-116774 was published for russh (Rust) Oct 30, 2026
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages Low
CVE-2026-116696 was published for russh (Rust) Oct 30, 2026
Hama1cco Credited to Hama1cco
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets Moderate
CVE-2026-116773 was published for russh (Rust) Oct 30, 2026
Hama1cco Credited to Hama1cco
GraphQL-core has denial of service via memory leak in aborted validations High
CVE-2026-119286 was published for graphql-core (pip) Oct 30, 2026
riodw Credited to riodw and Fire162 Fire162 Fire162
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client High
CVE-2026-118669 was published for oauthlib (pip) Oct 30, 2026
Str1ckl4nd Credited to Str1ckl4nd
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations Moderate
CVE-2026-116677 was published for openwisp-controller (pip) Oct 30, 2026
KasperBuilds Credited to KasperBuilds
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads Moderate
CVE-2026-119285 was published for github.com/gofiber/fiber/v2 (Go) Oct 30, 2026
signalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher Moderate
GHSA-7wpf-ch8f-5f4x was published for signalk-server (npm) Oct 30, 2026
zachariah-mithani Credited to zachariah-mithani
Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution Critical
GHSA-4xm8-rg9h-jhq2 was published for @signalk/resources-provider (npm) Oct 30, 2026
jasontimwong Credited to jasontimwong
imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution Critical
GHSA-hff9-5pqw-6w9f was published for github.com/imgproxy/imgproxy (Go) Oct 30, 2026
mateofumis Credited to mateofumis, JasonPuglisi, and JacobBrackett JasonPuglisi JasonPuglisi
JacobBrackett JacobBrackett
imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash High
GHSA-494m-4556-wf5p was published for github.com/imgproxy/imgproxy/v3 (Go) Oct 30, 2026
haileyok Credited to haileyok
imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field High
GHSA-mmq5-xm89-9pfg was published for github.com/imgproxy/imgproxy/v3 (Go) Oct 30, 2026
haileyok Credited to haileyok
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS Moderate
GHSA-2wrx-84qj-4pcg was published for github.com/anacrolix/torrent (Go) Oct 30, 2026
Reload3d Credited to Reload3d
AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE Moderate
CVE-2026-96634 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
zdi-disclosures Credited to zdi-disclosures and vrana vrana vrana
AdminNeo SQLite Database-List Drop Arbitrary File Deletion High
CVE-2026-96633 was published for adminneo-org/adminneo (Composer) Oct 30, 2026
slpoiuewalspoid-dotcom Credited to slpoiuewalspoid-dotcom and vrana vrana vrana
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database