Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

4,494 advisories

Loading
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). ... High Unreviewed
CVE-2026-87369 was published Oct 21, 2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition... Moderate Unreviewed
CVE-2026-83400 was published Oct 21, 2026
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient... Moderate Unreviewed
CVE-2026-101587 was published Oct 21, 2026
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient... High Unreviewed
CVE-2026-101572 was published Oct 21, 2026
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle... High Unreviewed
CVE-2026-101520 was published Oct 21, 2026
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). ... High Unreviewed
CVE-2026-101508 was published Oct 21, 2026
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).... Moderate Unreviewed
CVE-2026-101399 was published Oct 21, 2026
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:... Moderate Unreviewed
CVE-2026-101389 was published Oct 21, 2026
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS High
CVE-2026-112400 was published for Pillow (pip) Oct 20, 2026
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) High
CVE-2026-111758 was published for markdown-it (npm) Oct 20, 2026
adriank31 Credited to adriank31
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled Low
CVE-2026-111766 was published for markdown-it (npm) Oct 20, 2026
JarLob Credited to JarLob
AIOHTTP: File descriptor exhaustion in multipart requests High
CVE-2026-111066 was published for aiohttp (pip) Oct 20, 2026
nemoola Credited to nemoola and Dreamsorcerer Dreamsorcerer Dreamsorcerer
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory High
CVE-2026-113658 was published for apostrophe (npm) Oct 20, 2026
bp0lr Credited to bp0lr
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service High
CVE-2026-113666 was published for @apostrophecms/db-connect (npm) Oct 20, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR) High
CVE-2026-111751 was published for @angular/router (npm) Oct 20, 2026
SkyZeroZx Credited to SkyZeroZx, atscott, and alan-agius4 atscott atscott
alan-agius4 alan-agius4
In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes... High Unreviewed
CVE-2026-113619 was published Oct 20, 2026
Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1. Moderate Unreviewed
CVE-2026-113401 was published Oct 20, 2026
@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR) High
CVE-2026-111752 was published for @angular/router (npm) Oct 20, 2026
SkyZeroZx Credited to SkyZeroZx, atscott, and alan-agius4 atscott atscott
alan-agius4 alan-agius4
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes High
CVE-2026-111759 was published for markdown-it (npm) Oct 20, 2026
GSGFs7 Credited to GSGFs7
A vulnerability in the bulk port configuration functionality could allow an unauthenticated... Moderate Unreviewed
CVE-2026-43848 was published Oct 20, 2026
Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion... High Unreviewed
CVE-2026-112782 was published Oct 19, 2026
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is... Moderate Unreviewed
CVE-2026-112300 was published Oct 19, 2026
A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N... High Unreviewed
CVE-2025-52290 was published Oct 19, 2026
IBM MQ could allow an authenticated attacker to cause a denial of service due to improper... Moderate Unreviewed
CVE-2026-12343 was published Oct 19, 2026
A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted... Low Unreviewed
CVE-2026-112157 was published Oct 19, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database