Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
101
GitHub Actions
54
Go
4,295
Maven
5,000+
npm
5,000+
NuGet
1,029
pip
5,000+
Pub
13
RubyGems
1,107
Rust
1,492
Swift
61
Unreviewed advisories
All unreviewed
5,000+

13 advisories

Loading
Incomplete validation in `SparseAdd` Moderate
CVE-2021-29609 was published for tensorflow (pip) May 21, 2021
Incomplete validation in `tf.raw_ops.CTCLoss` Moderate
CVE-2021-29613 was published for tensorflow (pip) May 21, 2021
Interpreter crash from `tf.io.decode_raw` Moderate
CVE-2021-29614 was published for tensorflow (pip) May 21, 2021
OpenZeppelin Contracts initializer reentrancy may lead to double initialization Moderate
CVE-2022-39384 was published for @openzeppelin/contracts (npm) Dec 14, 2021
Resource Exhaustion Denial of Service in http-proxy-agent Moderate
CVE-2019-10196 was published for http-proxy-agent (npm) Jan 6, 2022
Improper Initialization in Pillow Moderate
CVE-2022-22815 was published for Pillow (pip) Jan 12, 2022
sunSUNQ Credited to sunSUNQ
Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe Moderate
CVE-2023-22466 was published for tokio (Rust) Jan 6, 2023
mhils Credited to mhils
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure Moderate
CVE-2023-40349 was published for org.jenkins-ci.plugins:gogs-webhook (Maven) Aug 16, 2023
Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service Moderate
CVE-2024-12289 was published for github.com/hashicorp/boundary (Go) Dec 13, 2024
IdMap from_iter may lead to uninitialized memory being freed on drop Moderate
GHSA-qq4c-hm99-979m was published for id-map (Rust) Aug 18, 2025
ArrayQueue's push_front is not panic-safe Moderate
GHSA-xqjr-wfx3-gmxv was published for array-queue (Rust) Sep 2, 2025
DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) Moderate
GHSA-cmwh-pvxp-8882 was published for dompurify (npm) Jun 18, 2026
trace37labs Credited to trace37labs
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance Moderate
CVE-2026-54777 was published for CoreWCF.NetNamedPipe (NuGet) Jun 19, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database