Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,191
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

7,246 advisories

Loading
Keycloak has authentication bypass via jwt algorithm confusion High
CVE-2026-11800 was published for org.keycloak:keycloak-services (Maven) Nov 3, 2026
MariaDB Connector/J: Rogue server can drive large heap allocations from server-declared lengths in OK packets Moderate
CVE-2026-119276 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: Length-encoded integers larger than Integer.MAX_VALUE were truncated before being used as lengths Moderate
CVE-2026-119279 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: XA recover() trusted server-supplied gtrid and bqual lengths Low
CVE-2026-119280 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
MariaDB Connector/J: LOAD DATA LOCAL INFILE file check could be satisfied by text inside quoted identifiers, letting a malicious server read client files Moderate
CVE-2026-119210 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
buxu Credited to buxu
MariaDB Connector/J: Server could switch character_set_results away from UTF-8 without the client noticing Moderate
CVE-2026-119281 was published for org.mariadb.jdbc:mariadb-java-client (Maven) Oct 30, 2026
fg0x0 Credited to fg0x0
NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571 Moderate
CVE-2026-54442 was published for gov.nsa.emissary:emissary (Maven) Oct 30, 2026
decsecre583 Credited to decsecre583 and ranjiGT ranjiGT ranjiGT
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass High
CVE-2026-9086 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing Moderate
CVE-2026-9083 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak allows unauthorized access to resources via uma permission ticket bypass Moderate
CVE-2026-9799 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
Keycloak vulnerable to authorization bypass via incorrect uri comparison High
CVE-2026-9800 was published for org.keycloak:keycloak-policy-enforcer (Maven) Oct 29, 2026
Keycloak: Attacker can re-enable and take over disabled clients via registration access token Moderate
CVE-2026-9705 was published for org.keycloak:keycloak-services (Maven) Oct 29, 2026
opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing Moderate
CVE-2026-118259 was published for io.opentelemetry:opentelemetry-api (Maven) Oct 28, 2026
snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods High
CVE-2026-93451 was published for org.xerial.snappy:snappy-java (Maven) Oct 27, 2026
August829 Credited to August829
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite Moderate
CVE-2026-116590 was published for org.xerial.snappy:snappy-java (Maven) Oct 27, 2026
snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha High
CVE-2026-108106 was published for org.xerial.snappy:snappy-java (Maven) Oct 27, 2026
1seal Credited to 1seal, EndlssNightmare, taer, apvxlab, August829, and trnguyencflt EndlssNightmare EndlssNightmare
taer taer apvxlab apvxlab August829 August829 trnguyencflt trnguyencflt
Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation High
CVE-2026-102554 was published for com.google.guava:guava (Maven) Oct 27, 2026
kemrec Credited to kemrec
OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies Moderate
CVE-2026-113730 was published for ognl:ognl (Maven) Oct 21, 2026
garymao Credited to garymao
A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure Moderate
CVE-2026-111762 was published for org.a2aproject.sdk:a2a-java-sdk-transport-rest (Maven) Oct 20, 2026
ehsavoie Credited to ehsavoie
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix High
CVE-2026-111765 was published for org.a2aproject.sdk:a2a-java-sdk-http-client-android (Maven) Oct 20, 2026
north-echo Credited to north-echo
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery Moderate
CVE-2026-111761 was published for org.a2aproject.sdk:a2a-java-sdk-server-common (Maven) Oct 20, 2026
asishinfosec Credited to asishinfosec
A2A Java SDK has a fail-open default task authorization High
CVE-2026-111764 was published for org.a2aproject.sdk:a2a-java-sdk-server-common (Maven) Oct 20, 2026
asishinfosec Credited to asishinfosec
A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect Moderate
CVE-2026-111763 was published for org.a2aproject.sdk:a2a-java-sdk-parent (Maven) Oct 20, 2026
ehsavoie Credited to ehsavoie
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS High
CVE-2026-102834 was published for org.bytedeco:javacv (Maven) Oct 16, 2026
tinyb0y Credited to tinyb0y
Junrar: RarVM VM_JMP maxOpCount bypass causes infinite CPU loop during RAR4 extraction High
CVE-2026-97370 was published for com.github.junrar:junrar (Maven) Oct 15, 2026
dds921 Credited to dds921 and KeenSecurityLab KeenSecurityLab KeenSecurityLab
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database