Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,191
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

569 advisories

Loading
Tornado: Open redirect in RedirectHandler via protocol-relative URLs Low
CVE-2026-116578 was published for tornado (pip) Oct 28, 2026
gn00295120 Credited to gn00295120
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server Low
CVE-2026-115917 was published for vllm (pip) Oct 28, 2026
prnjlksingh Credited to prnjlksingh and jperezdealgaba jperezdealgaba jperezdealgaba
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock Low
CVE-2026-112941 was published for filelock (pip) Oct 28, 2026
filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker Low
CVE-2026-112912 was published for filelock (pip) Oct 28, 2026
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts Low
CVE-2026-114614 was published for authlib (pip) Oct 27, 2026
KrisKennawayDD Credited to KrisKennawayDD
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation Low
CVE-2026-83813 was published for Twisted (pip) Oct 27, 2026
tinyb0y Credited to tinyb0y
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database Low
CVE-2026-112913 was published for filelock (pip) Oct 23, 2026
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break Low
CVE-2026-112907 was published for filelock (pip) Oct 23, 2026
virtualenv: Pip seeding with download omits wheel digest verification Low
CVE-2026-113717 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Downloaded wheel selection and caching precede verification Low
CVE-2026-113714 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Venv configuration readback can reinterpret path boundaries Low
CVE-2026-113715 was published for virtualenv (pip) Oct 23, 2026
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description Low
GHSA-xmj3-9gf7-h52w was published for setuptools (pip) Oct 23, 2026
Hades2508 Credited to Hades2508
pypdf: Unvalidated JPEG image data loading Low
CVE-2026-113786 was published for pypdf (pip) Oct 21, 2026
djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool Low
CVE-2026-113731 was published for djust (pip) Oct 21, 2026
KulFilip Credited to KulFilip
AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies Low
CVE-2026-111749 was published for aiohttp (pip) Oct 20, 2026
denyspakizh-tob Credited to denyspakizh-tob and Dreamsorcerer Dreamsorcerer Dreamsorcerer
ClickMigrate has Path Traversal in "revision -m" argument Low
CVE-2026-68549 was published for ClickMigrate (pip) Oct 16, 2026
BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction Low
CVE-2026-14966 was published for bbot (pip) Oct 14, 2026
tonghuaroot Credited to tonghuaroot
Apprise forwards configured auth headers across cross-origin HTTP redirects Low
CVE-2026-59180 was published for apprise (pip) Oct 14, 2026
gistrec Credited to gistrec
Strawberry legacy graphql-ws retains naturally completed subscription slots Low
CVE-2026-107727 was published for strawberry-graphql (pip) Oct 9, 2026
Hama1cco Credited to Hama1cco
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` Low
CVE-2026-107293 was published for pydantic-ai (pip) Oct 8, 2026
mauriceng98 Credited to mauriceng98 and sean-kim05 sean-kim05 sean-kim05
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False` Low
CVE-2026-107291 was published for pydantic-ai (pip) Oct 8, 2026
Docling: Configured HTTP headers sent to every remote image host named by a document Low
CVE-2026-105742 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle Low
CVE-2026-105752 was published for vllm (pip) Oct 6, 2026
KernelClint Credited to KernelClint, dhalf, and jperezdealgaba dhalf dhalf
jperezdealgaba jperezdealgaba
wlc may disclose API tokens to project-configured URLs Low
CVE-2026-62364 was published for wlc (pip) Sep 22, 2026
nijel Credited to nijel, type5afe, and visionxstack type5afe type5afe
visionxstack visionxstack
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` Low
GHSA-wwv5-g3v4-889x was published for tornado (pip) Sep 1, 2026
sec-reex Credited to sec-reex and arpitjain099 arpitjain099 arpitjain099
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database