Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

179 advisories

Loading
In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned... High Unreviewed
CVE-2026-12817 was published Aug 3, 2026
In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when... High Unreviewed
CVE-2026-59642 was published Aug 3, 2026
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest... Critical Unreviewed
CVE-2026-75625 was published Aug 18, 2026
In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical... Moderate Unreviewed
CVE-2026-56416 was published Jul 22, 2026
A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication... High Unreviewed
CVE-2026-9653 was published Jul 14, 2026
melange: Incomplete package integrity verification allows data section substitution High
CVE-2026-54174 was published for chainguard.dev/apko (Go) Jul 10, 2026
xnox Credited to xnox and egibs egibs egibs
Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption Moderate
CVE-2026-8149 was published for org.bouncycastle:bcprov-lts8on (Maven) May 8, 2026
discerningdev Credited to discerningdev
nginx-ui Backup Restore Allows Tampering with Encrypted Backups Critical
CVE-2026-33026 was published for github.com/0xJacky/Nginx-UI (Go) Mar 30, 2026
dapickle Credited to dapickle and cookesan cookesan cookesan
wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the... Moderate Unreviewed
CVE-2026-8720 was published Jun 26, 2026
pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field Moderate
CVE-2026-50021 was published for pnpm (npm) Jun 26, 2026
tempcollab Credited to tempcollab
Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt... Moderate Unreviewed
CVE-2026-49230 was published Jun 19, 2026
A security issue exists within 1769 CompactLogix controllers due to the missing validation of... High Unreviewed
CVE-2025-11694 was published Jun 16, 2026
Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input... Critical Unreviewed
CVE-2026-34182 was published Jun 9, 2026
Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files... High Unreviewed
CVE-2026-34181 was published Jun 9, 2026
Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler Moderate
CVE-2026-8597 was published for sagemaker (pip) May 21, 2026
Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs Critical
GHSA-cwfq-rfcr-8hmp was published for zebrad (Rust) May 7, 2026
sangsoo-osec Credited to sangsoo-osec, defuse, mpguerra, and upbqdn defuse defuse
mpguerra mpguerra upbqdn upbqdn
Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin Moderate
CVE-2023-48795 was published for golang.org/x/crypto (Go) Dec 18, 2023
TrueSkrillor Credited to TrueSkrillor, lambdafu, sugar700, and levpachmanov lambdafu lambdafu
sugar700 sugar700 levpachmanov levpachmanov
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can... Critical Unreviewed
CVE-2024-3596 was published Jul 9, 2024
Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output Critical
GHSA-pvmv-cwg8-v6c8 was published for zebra-script (Rust) May 8, 2026
sangsoo-osec Credited to sangsoo-osec and fivelittleducks fivelittleducks fivelittleducks
In wolfSSL's EVP layer, the ChaCha20-Poly1305 AEAD decryption path in wolfSSL_EVP_CipherFinal ... High Unreviewed
CVE-2026-5479 was published Apr 10, 2026
A padding oracle exists in wolfSSL's PKCS7 CBC decryption that could allow an attacker to recover... Moderate Unreviewed
CVE-2026-5504 was published Apr 10, 2026
SP1 V6 Recursion Circuit Row-Count Binding Gap High
CVE-2026-40323 was published for sp1_prover (Rust) Apr 14, 2026
An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi... Moderate Unreviewed
CVE-2020-26141 was published May 24, 2022
SzafirHost downloads necessary files in the context of the initiating web page. When called,... High Unreviewed
CVE-2026-26928 was published Apr 2, 2026
Incus does not verify combined fingerprint when downloading images from simplestreams servers High
CVE-2026-33542 was published for github.com/lxc/incus/v6/client (Go) Mar 27, 2026
wl2018 Credited to wl2018 and stgraber stgraber stgraber
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database