Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,863
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,158
Rust
1,586
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,513
Rust
20

13,355 advisories

Loading
Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in... Critical Unreviewed
CVE-2026-63569 was published Oct 2, 2026
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which... Moderate Unreviewed
CVE-2025-31980 was published Oct 1, 2026
fastify vulnerable to request body replacement via an async validation result collision High
CVE-2026-84504 was published for fastify (npm) Sep 30, 2026
velgusgus599 Credited to velgusgus599, UlisesGascon, climba03003, and mcollina UlisesGascon UlisesGascon
climba03003 climba03003 mcollina mcollina
fastify vulnerable to request validation bypass via skipped boolean false schemas High
CVE-2026-84469 was published for fastify (npm) Sep 30, 2026
schecthellraiser606 Credited to schecthellraiser606, mcollina, UlisesGascon, and climba03003 mcollina mcollina
UlisesGascon UlisesGascon climba03003 climba03003
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened High
CVE-2026-102823 was published for russh (Rust) Sep 30, 2026
sonicnew Credited to sonicnew
Taskcluster is the task execution framework that supports Mozilla's continuous integration and... High Unreviewed
CVE-2026-55094 was published Sep 30, 2026
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer... Moderate Unreviewed
CVE-2026-47542 was published Sep 30, 2026
VIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer... Moderate Unreviewed
CVE-2026-47543 was published Sep 30, 2026
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an... Moderate Unreviewed
CVE-2026-47547 was published Sep 30, 2026
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an... Moderate Unreviewed
CVE-2026-47546 was published Sep 30, 2026
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer... Moderate Unreviewed
CVE-2026-47522 was published Sep 30, 2026
MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path.... Moderate Unreviewed
CVE-2026-103389 was published Sep 30, 2026
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. ... High Unreviewed
CVE-2026-103321 was published Sep 30, 2026
Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds... Unknown Unreviewed
CVE-2026-85532 was published Sep 30, 2026
Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to... Moderate Unreviewed
CVE-2026-93995 was published Sep 30, 2026
MISP contains an improper input validation vulnerability in its ORM save path. When a user... High Unreviewed
CVE-2026-103237 was published Sep 30, 2026
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing Moderate
GHSA-g57g-f23g-4646 was published for nodemailer (npm) Sep 29, 2026
ZeroXJacks Credited to ZeroXJacks
Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote... High Unreviewed
CVE-2026-95381 was published Sep 29, 2026
Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote... Moderate Unreviewed
CVE-2026-95382 was published Sep 29, 2026
Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote... Moderate Unreviewed
CVE-2026-95364 was published Sep 29, 2026
Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote... High Unreviewed
CVE-2026-95341 was published Sep 29, 2026
Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote... High Unreviewed
CVE-2026-95276 was published Sep 29, 2026
undici vulnerable to response truncation via oversized chunked responses in the dump interceptor Low
CVE-2026-84947 was published for undici (npm) Sep 29, 2026
mcollina Credited to mcollina and UlisesGascon UlisesGascon UlisesGascon
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer High
CVE-2026-102677 was published for electron (npm) Sep 29, 2026
varisys Credited to varisys
Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4 and... Critical Unreviewed
CVE-2026-100787 was published Sep 29, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database