Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

37,226 advisories

Loading
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall` Critical
CVE-2026-35002 was published for agno (pip) Oct 27, 2026
harshsinha03 Credited to harshsinha03
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow High
CVE-2026-49272 was published for oauthlib (pip) Oct 27, 2026
hekhuisk Credited to hekhuisk
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) Critical
CVE-2026-48705 was published for monai (pip) Oct 27, 2026
cldrn Credited to cldrn
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS Low
CVE-2026-46350 was published for dcmjs (npm) Oct 27, 2026
cldrn Credited to cldrn
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins High
CVE-2026-34157 was published for github.com/wailsapp/wails/v2 (Go) Oct 27, 2026
Saku0512 Credited to Saku0512
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter High
CVE-2026-33944 was published for dolibarr/dolibarr (Composer) Oct 27, 2026
F37I5H Credited to F37I5H
Ajenti has potential Remote Code Execution High
CVE-2026-27975 was published for aj (pip) Oct 27, 2026
kiarn Credited to kiarn and wcakir wcakir wcakir
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name Moderate
CVE-2026-112937 was published for filelock (pip) Oct 23, 2026
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database Low
CVE-2026-112913 was published for filelock (pip) Oct 23, 2026
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break Low
CVE-2026-112907 was published for filelock (pip) Oct 23, 2026
virtualenv: Temporary app-data can leave dangling seed package links Moderate
CVE-2026-113713 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Pip seeding with download omits wheel digest verification Low
CVE-2026-113717 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Downloaded wheel selection and caching precede verification Low
CVE-2026-113714 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Xonsh activation literals depend on the script decoding codec High
CVE-2026-113718 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Seeded files retain permissions from an older cache Moderate
CVE-2026-113720 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Bash prompt values can change meaning under older compatibility modes High
CVE-2026-113723 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Venv configuration readback can reinterpret path boundaries Low
CVE-2026-113715 was published for virtualenv (pip) Oct 23, 2026
virtualenv: Seed replacement does not contain metadata deletion paths Moderate
CVE-2026-113719 was published for virtualenv (pip) Oct 23, 2026
MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint High
CVE-2026-109461 was published for @azure/msal-node (npm) Oct 23, 2026
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings High
CVE-2026-109869 was published for undici (npm) Oct 23, 2026
hanityx Credited to hanityx, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
undici vulnerable to Denial of Service via unbounded memory in the EventSource parser Moderate
CVE-2026-109924 was published for undici (npm) Oct 23, 2026
iamibi Credited to iamibi, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens Moderate
CVE-2026-109841 was published for undici (npm) Oct 23, 2026
Kushalkhemka Credited to Kushalkhemka, mayank-jangid-moon, skigeek16, opensec-intelligence, mcollina, and UlisesGascon mayank-jangid-moon mayank-jangid-moon
skigeek16 skigeek16 opensec-intelligence opensec-intelligence mcollina mcollina UlisesGascon UlisesGascon
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body Low
CVE-2026-115897 was published for serialize-javascript (npm) Oct 23, 2026
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown High
CVE-2026-113872 was published for multer (npm) Oct 23, 2026
santihabib Credited to santihabib, UlisesGascon, and bjohansebas UlisesGascon UlisesGascon
bjohansebas bjohansebas
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints Moderate
CVE-2026-115886 was published for mlflow (pip) Oct 23, 2026
adamyordan Credited to adamyordan
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database