Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,143
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,555
Rust
21

551 advisories

Loading
Strawberry legacy graphql-ws retains naturally completed subscription slots Low
CVE-2026-107727 was published for strawberry-graphql (pip) Oct 9, 2026
Hama1cco Credited to Hama1cco
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` Low
CVE-2026-107293 was published for pydantic-ai (pip) Oct 8, 2026
mauriceng98 Credited to mauriceng98 and sean-kim05 sean-kim05 sean-kim05
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False` Low
CVE-2026-107291 was published for pydantic-ai (pip) Oct 8, 2026
Docling: Configured HTTP headers sent to every remote image host named by a document Low
CVE-2026-105742 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff
vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle Low
CVE-2026-105752 was published for vllm (pip) Oct 6, 2026
KernelClint Credited to KernelClint, dhalf, and jperezdealgaba dhalf dhalf
jperezdealgaba jperezdealgaba
wlc may disclose API tokens to project-configured URLs Low
CVE-2026-62364 was published for wlc (pip) Sep 22, 2026
nijel Credited to nijel, type5afe, and visionxstack type5afe type5afe
visionxstack visionxstack
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie` Low
GHSA-wwv5-g3v4-889x was published for tornado (pip) Sep 1, 2026
sec-reex Credited to sec-reex and arpitjain099 arpitjain099 arpitjain099
kas Persistently Disables SSH Host Key Checking Low
CVE-2026-54548 was published for kas (pip) Aug 26, 2026
shubtheone Credited to shubtheone
NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure Low
CVE-2026-71514 was published for nltk (pip) Aug 22, 2026
Wagtail: Identification of documents by SHA1 hash Low
GHSA-92hv-j533-69wc was published for wagtail (pip) Aug 20, 2026
gasman Credited to gasman, unknownhad, and RealOrangeOne unknownhad unknownhad
RealOrangeOne RealOrangeOne
MobSF has SSRF port restriction bypass in assetlinks_check Low
CVE-2026-68927 was published for mobsf (pip) Aug 18, 2026
DavidCarliez Credited to DavidCarliez
NLTK network URL validation permits SSRF to RFC 6598 shared-address-space hosts Low
CVE-2026-12372 was published for nltk (pip) Aug 10, 2026
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint Low
CVE-2026-70483 was published for open-webui (pip) Aug 4, 2026
GabrielGomesAL Credited to GabrielGomesAL and Classic298 Classic298 Classic298
datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas Low
CVE-2026-55403 was published for datamodel-code-generator (pip) Jul 28, 2026
thegr1ffyn Credited to thegr1ffyn
Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding Low
CVE-2026-59215 was published for open-webui (pip) Jul 24, 2026
DavidCarliez Credited to DavidCarliez and Classic298 Classic298 Classic298
Open WebUI: Cross-user model-list exposure via static cache key in get_all_models (aiocache key= vs key_builder= misuse) Low
CVE-2026-59213 was published for open-webui (pip) Jul 24, 2026
Classic298 Credited to Classic298
Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave) Low
CVE-2026-59715 was published for open-webui (pip) Jul 24, 2026
sfwani Credited to sfwani and Classic298 Classic298 Classic298
Open WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation Low
CVE-2026-59226 was published for open-webui (pip) Jul 24, 2026
rexpository Credited to rexpository and Classic298 Classic298 Classic298
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion Low
GHSA-464c-974j-9xm6 was published for @aws-cdk/aws-codebuild (Go) Jul 24, 2026
ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape Low
CVE-2026-63632 was published for onnx (pip) Jul 24, 2026
MinicoAI Credited to MinicoAI
JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`) Low
GHSA-whvh-wf3x-g77j was published for jupyterlab (pip) Jul 22, 2026
de3erve-hunter Credited to de3erve-hunter, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks Low
CVE-2026-59821 was published for litellm (pip) Jul 22, 2026
yaaras Credited to yaaras
LiteLLM: Local file read via request-supplied OIDC file references Low
CVE-2026-59819 was published for litellm (pip) Jul 22, 2026
Wasmtime: Memory leak in C API with `externref` and `anyref` types Low
CVE-2025-61670 was published for wasmtime-bin (pip) Jul 14, 2026
alexcrichton Credited to alexcrichton
Keras: tar extraction permits symlink-based path traversal Low
CVE-2026-12482 was published for keras (pip) Jul 14, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database