Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,191
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

267 advisories

Loading
Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy... High Unreviewed
CVE-2026-122306 was published Nov 5, 2026
rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's... High Unreviewed
CVE-2026-119741 was published Nov 3, 2026
Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote... High Unreviewed
CVE-2026-121437 was published Nov 3, 2026
pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding High
CVE-2026-119196 was published for pyasn1 (pip) Oct 30, 2026
manus-use Credited to manus-use, manus-pi, ucsurf, and adriank31 manus-pi manus-pi
ucsurf ucsurf adriank31 adriank31
pyasn1 has quadratic-complexity denial of service in binary REAL decoding High
CVE-2026-119197 was published for pyasn1 (pip) Oct 30, 2026
manus-use Credited to manus-use
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding High
CVE-2026-119195 was published for pyasn1 (pip) Oct 30, 2026
alimony Credited to alimony, manus-pi, and adriank31 manus-pi manus-pi
adriank31 adriank31
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding High
CVE-2026-119194 was published for pyasn1 (pip) Oct 30, 2026
droideck Credited to droideck
anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS Moderate
GHSA-2wrx-84qj-4pcg was published for github.com/anacrolix/torrent (Go) Oct 30, 2026
Reload3d Credited to Reload3d
DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding... Unknown Unreviewed
CVE-2026-87768 was published Oct 30, 2026
decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs High
CVE-2026-118664 was published for decode-uri-component (npm) Oct 29, 2026
gdegrange Credited to gdegrange
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline... High Unreviewed
CVE-2019-25781 was published Oct 29, 2026
python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote... High Unreviewed
CVE-2026-118694 was published Oct 29, 2026
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding Moderate
CVE-2026-116577 was published for tornado (pip) Oct 28, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
RE2JS: Quadratic-time denial of service in re2js lookbehind matching High
CVE-2026-116795 was published for re2js (npm) Oct 28, 2026
Nois3 Credited to Nois3
MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated "=?" sequences in... High Unreviewed
CVE-2026-116270 was published Oct 28, 2026
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a... High Unreviewed
CVE-2026-116133 was published Oct 28, 2026
MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented error messages... High Unreviewed
CVE-2026-116267 was published Oct 28, 2026
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled... High Unreviewed
CVE-2026-118035 was published Oct 28, 2026
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled... High Unreviewed
CVE-2026-118036 was published Oct 28, 2026
When coalescing adjacent text nodes in addText and fosterParent, appending to an existing... High Unreviewed
CVE-2026-78661 was published Oct 28, 2026
Go JOSE: DoS when parsing JWKs that contain RSA keys High
CVE-2026-116587 was published for github.com/go-jose/go-jose/v3 (Go) Oct 27, 2026
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service Moderate
GHSA-4g23-2xm8-66gc was published for nodemailer (npm) Oct 27, 2026
manus-use Credited to manus-use
svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer:... High Unreviewed
CVE-2026-117540 was published Oct 27, 2026
Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in... High Unreviewed
CVE-2026-116872 was published Oct 27, 2026
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words High
GHSA-f2hq-32vh-53cc was published for postal-mime (npm) Oct 23, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database