Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

219 advisories

Loading
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode... High Unreviewed
CVE-2026-87081 was published Sep 22, 2026
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion... High Unreviewed
CVE-2026-87079 was published Sep 22, 2026
roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML... High Unreviewed
CVE-2026-92987 was published Sep 17, 2026
A BIND recursive resolver may experience excessive resource consumption if it encounters large... Moderate Unreviewed
CVE-2026-19668 was published Sep 16, 2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22... Moderate Unreviewed
CVE-2026-86349 was published Sep 14, 2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22... Moderate Unreviewed
CVE-2026-12882 was published Sep 14, 2026
Duplicate Advisory: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser) High
GHSA-vm5r-23w9-m8hx was published for nodemailer (npm) Sep 13, 2026 • withdrawn
t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in... High Unreviewed
CVE-2026-87822 was published Sep 9, 2026
league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in... High Unreviewed
CVE-2024-58382 was published Sep 9, 2026
PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in... Moderate Unreviewed
CVE-2023-54395 was published Sep 9, 2026
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list High
GHSA-2x7j-588g-ccc2 was published for nodemailer (npm) Sep 8, 2026
e1abrador Credited to e1abrador
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources High
CVE-2026-84375 was published for js-yaml (npm) Sep 8, 2026
xmldom: Quadratic-time attribute deduplication High
CVE-2026-83613 was published for @xmldom/xmldom (npm) Sep 8, 2026
karfau Credited to karfau
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge High
CVE-2026-83614 was published for @xmldom/xmldom (npm) Sep 8, 2026
karfau Credited to karfau and Solan23 Solan23 Solan23
HTTPX2: Quadratic SSE line buffering can cause CPU denial of service Moderate
CVE-2026-84378 was published for httpx2 (pip) Sep 8, 2026
GalaxySnail Credited to GalaxySnail
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing Moderate
CVE-2026-75596 was published for io.netty:netty-handler (Maven) Sep 8, 2026
mauriceng98 Credited to mauriceng98
league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service... High Unreviewed
CVE-2026-86434 was published Sep 7, 2026
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the... High Unreviewed
CVE-2026-86433 was published Sep 7, 2026
league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in... High Unreviewed
CVE-2026-86430 was published Sep 7, 2026
commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the... High Unreviewed
CVE-2026-86428 was published Sep 7, 2026
commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the... High Unreviewed
CVE-2026-86435 was published Sep 7, 2026
The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains... High Unreviewed
CVE-2026-86429 was published Sep 7, 2026
MOOS-IvP versions through 24.8.1 contain a quadratic processing vulnerability in uFldNodeComms... High Unreviewed
CVE-2026-85446 was published Sep 4, 2026
stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — small crafted JSON blocks the event loop for seconds→minutes (DoS) Moderate
CVE-2026-71429 was published for stream-json (npm) Sep 3, 2026
ataberk-xyz Credited to ataberk-xyz
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace Moderate
CVE-2026-82398 was published for pypdf (pip) Sep 2, 2026
arpitjain099 Credited to arpitjain099
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database