Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
64
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,234
pip
5,000+
Pub
14
RubyGems
1,210
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,594
Rust
25

37,794 advisories

Loading
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens Critical
CVE-2026-100397 was published for rucio (pip) Nov 13, 2026
thebatou Credited to thebatou
Soup Sieve: Polynomial-time denial of service in the descendant combinator High
CVE-2026-126190 was published for soupsieve (pip) Nov 13, 2026
Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time Moderate
CVE-2026-126192 was published for soupsieve (pip) Nov 13, 2026
NotAFlightRisk Credited to NotAFlightRisk
Active Storage: Possible arbitrary file write and read in image analysis Critical
CVE-2026-122006 was published for activestorage (RubyGems) Nov 12, 2026
Ry0taK Credited to Ry0taK
Action Pack: Possible DoS vulnerability in Action Controller Live streaming Moderate
CVE-2026-126072 was published for actionpack (RubyGems) Nov 12, 2026
Action Pack: Possible sensitive session information leak in Active Storage proxy mode Moderate
CVE-2026-126077 was published for actionpack (RubyGems) Nov 12, 2026
Action View: Possible XSS vulnerability in highlight helper Moderate
CVE-2026-126078 was published for actionview (RubyGems) Nov 12, 2026
Action View: Possible XSS vulnerability in strip_tags Moderate
CVE-2026-126070 was published for actionview (RubyGems) Nov 12, 2026
Action View: Possible XSS vulnerability in text helpers Moderate
CVE-2026-126079 was published for actionview (RubyGems) Nov 12, 2026
Active Storage: Unsigned Content-Type in GCS direct uploads with cache_control Moderate
CVE-2026-126084 was published for activestorage (RubyGems) Nov 12, 2026
Action Pack: Possible Strong Parameters Bypass in Parameters#each_key High
CVE-2026-126081 was published for actionpack (RubyGems) Nov 12, 2026
Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data Moderate
CVE-2026-128066 was published for Pillow (pip) Nov 12, 2026
LittlehamsterXu Credited to LittlehamsterXu and toporone toporone toporone
Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size High
CVE-2026-128067 was published for Pillow (pip) Nov 12, 2026
carlini Credited to carlini
Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`) Moderate
CVE-2026-126355 was published for hono (npm) Nov 12, 2026
AliAAlMousa Credited to AliAAlMousa
Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters Moderate
CVE-2026-126356 was published for hono (npm) Nov 12, 2026
nhamilton1 Credited to nhamilton1
Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix Moderate
CVE-2026-126357 was published for hono (npm) Nov 12, 2026
KunalShukla-Al Credited to KunalShukla-Al, seslo82, kian0417, and zachary-satterly seslo82 seslo82
kian0417 kian0417 zachary-satterly zachary-satterly
Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator Moderate
CVE-2026-126358 was published for hono (npm) Nov 12, 2026
quantumshiro Credited to quantumshiro, euriconicacio, and payku euriconicacio euriconicacio
payku payku
Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection Low
CVE-2026-126359 was published for hono (npm) Nov 12, 2026
@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation Moderate
CVE-2026-126367 was published for @grpc/grpc-js-xds (npm) Nov 12, 2026
adriank31 Credited to adriank31
@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied Moderate
CVE-2026-128065 was published for @grpc/grpc-js-xds (npm) Nov 12, 2026
koyokr Credited to koyokr
msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM High
CVE-2026-126366 was published for msgpack (RubyGems) Nov 12, 2026
cosmo0920 Credited to cosmo0920
Addressable display_uri can show misleading hosts with invalid Punycode A-labels Moderate
CVE-2026-126348 was published for addressable (RubyGems) Nov 12, 2026
tonghuaroot Credited to tonghuaroot
Addressable display_uri can show misleading hosts containing bidi and invisible characters Low
CVE-2026-126349 was published for addressable (RubyGems) Nov 12, 2026
andrewstellman Credited to andrewstellman
Addressable: Denial of service in URI path normalization Moderate
CVE-2026-126351 was published for addressable (RubyGems) Nov 12, 2026
Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js Low
CVE-2026-126363 was published for @astrojs/solid-js (npm) Nov 12, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database