GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
9 advisories
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
Moderate
CVE-2026-106121
was published
for
com.rabbitmq:amqp-client
(Maven)
Oct 7, 2026
simple-git allows command execution through unblocked Git configuration includes
High
CVE-2026-102826
was published
for
simple-git
(npm)
Oct 5, 2026
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
Moderate
GHSA-r4xh-jqrq-34v2
was published
for
smol-toml
(npm)
Oct 5, 2026
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
High
CVE-2026-104845
was published
for
seroval
(npm)
Oct 5, 2026
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk
Moderate
CVE-2026-104182
was published
for
stream-json
(npm)
Oct 5, 2026
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
High
CVE-2026-102990
was published
for
basic-ftp
(npm)
Oct 1, 2026
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
Moderate
GHSA-253c-mchw-3w2r
was published
for
markdown-it
(npm)
Sep 29, 2026
SVGO: removeScripts allows executable links through namespace and control-character bypasses
High
CVE-2026-84370
was published
for
svgo
(npm)
Sep 8, 2026
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
High
CVE-2026-75899
was published
for
fast-uri
(npm)
Sep 2, 2026
ProTip!
Advisories are also available from the
GraphQL API