Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,191
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

6,816 advisories

Loading
wger: Privilege escalation via trainer-login session chaining allows gym trainer to impersonate gym manager High
CVE-2026-43978 was published for wger (pip) May 14, 2026
KadirArslan Credited to KadirArslan and zuhairhalawa zuhairhalawa zuhairhalawa
djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path High
CVE-2026-61599 was published for djust (pip) Sep 16, 2026
zuhairhalawa Credited to zuhairhalawa
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow High
CVE-2026-49272 was published for oauthlib (pip) Oct 27, 2026
hekhuisk Credited to hekhuisk and Rania193 Rania193 Rania193
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE High
CVE-2026-61536 was published for banks (pip) Nov 5, 2026
aslein1413-sys Credited to aslein1413-sys
Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend Critical
GHSA-83x9-8wvq-rrcp was published for urwid (pip) Jul 18, 2026 • withdrawn
Django Vulnerable to Allocation of Resources Without Limits or Throttling Moderate
CVE-2025-26699 was published for Django (pip) Mar 6, 2025
Cao150702 Credited to Cao150702
Qiskit allows arbitrary code execution decoding QPY format versions < 13 Critical
CVE-2025-2000 was published for qiskit (pip) Mar 14, 2025
jakelishman Credited to jakelishman, mtreinish, and ElePT mtreinish mtreinish
ElePT ElePT
Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs Moderate
CVE-2026-39892 was published for cryptography (pip) Apr 8, 2026
ranjiGT Credited to ranjiGT
onnx Vulnerable to Path Traversal via Symlink High
CVE-2026-27489 was published for onnx (pip) Mar 31, 2026
pi3ch Credited to pi3ch and devjoinedthechat devjoinedthechat devjoinedthechat
NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite High
CVE-2026-33236 was published for nltk (pip) Mar 19, 2026
luis63e Credited to luis63e
NLTK has a Path Traversal issue High
CVE-2026-0847 was published for nltk (pip) Mar 4, 2026
antonisloukis Credited to antonisloukis
PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files High
CVE-2026-24747 was published for torch (pip) Jan 27, 2026
azraelxuemo Credited to azraelxuemo and khlaifiabilel khlaifiabilel khlaifiabilel
Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints Moderate
CVE-2026-45339 was published for open-webui (pip) May 14, 2026
aliceQWAS Credited to aliceQWAS, Classic298, and westonsteimel Classic298 Classic298
westonsteimel westonsteimel
Feast vulnerable to unsafe deserialization RCE in registry server via UDF proto Critical
CVE-2026-56121 was published for feast (pip) Jun 24, 2026
PercevalFox Credited to PercevalFox
Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE) Critical
CVE-2026-5366 was published for prefect (pip) Jun 20, 2026
bdalpe Credited to bdalpe
Stanza: RCE via pickle deserialization in the lemmatizer High
CVE-2026-115878 was published for stanza (pip) Nov 3, 2026
lexdotdev Credited to lexdotdev
Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dag High
CVE-2025-54550 was published for apache-airflow (pip) Apr 16, 2026 • withdrawn
maheshwarivijaykumar Credited to maheshwarivijaykumar
Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode High
CVE-2025-71340 was published for picklescan (pip) Aug 26, 2025
FredericDT Credited to FredericDT
Duplicate Advisory : Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode High
GHSA-mq7r-vm99-p7vx was published for picklescan (pip) Jun 26, 2026 • withdrawn
Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package Critical
CVE-2026-111497 was published for brotli (pip) Oct 22, 2026
aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence Low
CVE-2026-54279 was published for aiohttp (pip) Jun 15, 2026
denyspakizh-tob Credited to denyspakizh-tob, bdraco, cookesan, and RogerF5-Security bdraco bdraco
cookesan cookesan RogerF5-Security RogerF5-Security
Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs Critical
CVE-2026-18948 was published for feast (pip) Aug 10, 2026
patelchaitany Credited to patelchaitany
Vantage6: No limit on emails sent for password/MFA reset Low
CVE-2024-24769 was published for vantage6 (pip) Jun 5, 2026
cookesan Credited to cookesan
Vantage6: 2FA can be circumvented with hacked email access Moderate
CVE-2024-27928 was published for vantage6 (pip) Jun 5, 2026
cookesan Credited to cookesan
Apache Airflow: Authenticated users can bypass the `is_safe_url` check High
CVE-2026-40961 was published for apache-airflow (pip) Jun 1, 2026
maheshwarivijaykumar Credited to maheshwarivijaykumar
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database