Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
114
GitHub Actions
55
Go
4,608
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,528
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

824 advisories

Loading
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption Low
CVE-2026-55588 was published for oras.land/oras (Go) Aug 28, 2026
aditya19200 Credited to aditya19200
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure... Moderate Unreviewed
CVE-2026-47863 was published Aug 27, 2026
GitLab has remediated an issue in GitLab EE affecting all versions from 11.10 before 19.1.7, 19.2... Moderate Unreviewed
CVE-2025-10903 was published Aug 26, 2026
django CMS: Plugin move endpoint allows cyclic reparenting (DoS) High
CVE-2026-54623 was published for django-cms (pip) Aug 24, 2026
Zyy0530 Credited to Zyy0530, Str1ckl4nd, 7thParkk, and mauriceng98 Str1ckl4nd Str1ckl4nd
7thParkk 7thParkk mauriceng98 mauriceng98
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding High
CVE-2026-63202 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
Pig-Tail Credited to Pig-Tail
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary High
CVE-2026-63124 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
sondt99 Credited to sondt99 and VuiVeIshere VuiVeIshere VuiVeIshere
In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible Moderate Unreviewed
CVE-2026-68762 was published Aug 17, 2026
A flow has been identified into dnssec.c library, causing an infinite loop to dnsmasq service. An... Moderate Unreviewed
CVE-2026-13002 was published Aug 14, 2026
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an... High Unreviewed
CVE-2026-17229 was published Aug 13, 2026
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an... High Unreviewed
CVE-2026-17004 was published Aug 13, 2026
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local... Moderate Unreviewed
CVE-2026-18726 was published Aug 13, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... Moderate Unreviewed
CVE-2026-11932 was published Aug 12, 2026
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to... High Unreviewed
CVE-2026-16931 was published Aug 12, 2026
Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows... Moderate Unreviewed
CVE-2026-72712 was published Aug 11, 2026
In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on... High Unreviewed
CVE-2026-8798 was published Aug 8, 2026
Mermaid XY Charts are vulnerable to an infinite loop DoS Moderate
CVE-2026-71436 was published for mermaid (npm) Aug 6, 2026
aloisklink Credited to aloisklink
A flaw was found in libkcapi. A local attacker can influence an application that uses the... Moderate Unreviewed
CVE-2026-71227 was published Aug 5, 2026
re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) Moderate
CVE-2026-68499 was published for re2 (npm) Jul 31, 2026
ataberk-xyz Credited to ataberk-xyz
nanoid: custom generators can loop indefinitely when size is zero High
CVE-2026-67213 was published for nanoid (npm) Jul 29, 2026
ai Credited to ai and dimaman2001 dimaman2001 dimaman2001
nanoid: non-secure generators can loop indefinitely with negative size High
CVE-2026-67214 was published for nanoid (npm) Jul 29, 2026
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body... High Unreviewed
CVE-2026-66730 was published Jul 27, 2026
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go,... High Unreviewed
CVE-2026-43871 was published Jul 27, 2026
In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on... Moderate Unreviewed
CVE-2026-64290 was published Jul 25, 2026
ImageMagick: Infinite Loop in connected-components when providing invalid arguments Moderate
CVE-2026-55595 was published for Magick.NET-Q16-AnyCPU (NuGet) Jul 24, 2026
rexpository Credited to rexpository
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) High
CVE-2026-59935 was published for pypdf (pip) Jul 23, 2026
koltiradw Credited to koltiradw and stefan6419846 stefan6419846 stefan6419846
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database