Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

74 advisories

Loading
Grav: Decompression Bomb via ZipArchiver - Missing Extraction Limits Moderate
CVE-2026-61690 was published for getgrav/grav (Composer) Sep 2, 2026
alienkeric Credited to alienkeric
Duplicate Advisory: Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability Moderate
GHSA-v3f6-m9j2-437p was published for Microsoft.AspNetCore.Server.IISIntegration (NuGet) Sep 8, 2026 • withdrawn
Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability Moderate
CVE-2026-69304 was published for Microsoft.AspNetCore.Server.IISIntegration (NuGet) Sep 9, 2026
Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by... Moderate Unreviewed
CVE-2026-89321 was published Sep 14, 2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22... Moderate Unreviewed
CVE-2026-5132 was published Sep 14, 2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22... Moderate Unreviewed
CVE-2026-15814 was published Sep 14, 2026
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() Moderate
CVE-2026-59193 was published for getgrav/grav (Composer) Sep 16, 2026
Scriptmagum Credited to Scriptmagum
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37,... Moderate Unreviewed
CVE-2026-77021 was published Sep 21, 2026
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation Moderate
CVE-2026-77528 was published for autobahn (pip) Sep 22, 2026
hibrian827 Credited to hibrian827
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1... Moderate Unreviewed
CVE-2026-92573 was published Sep 25, 2026
Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data... Moderate Unreviewed
CVE-2026-66054 was published Oct 2, 2026
Duplicate Advisory: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) Moderate
GHSA-f4ch-vxwc-3p2m was published for docling (pip) Oct 6, 2026 • withdrawn
Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) Moderate
CVE-2026-105747 was published for docling (pip) Oct 6, 2026
jonathanlotan Credited to jonathanlotan and wittjeff wittjeff wittjeff
Keycloak: Denial of Service due to excessive SAMLRequest decompression Moderate
CVE-2026-2575 was published for org.keycloak:keycloak-saml-adapter-core (Maven) Mar 18, 2026
In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximum packet length... Moderate Unreviewed
CVE-2026-106585 was published Oct 6, 2026
ImageMagick before 6.9.13-55 and 7.x before 7.1.2-30 contains a security policy bypass in the MAT... Moderate Unreviewed
CVE-2026-105826 was published Oct 8, 2026
OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows... Moderate Unreviewed
CVE-2026-108750 was published Oct 11, 2026
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's... Moderate Unreviewed
CVE-2026-95502 was published Oct 13, 2026
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting... Moderate Unreviewed
CVE-2026-107335 was published Oct 8, 2026
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML... Moderate Unreviewed
CVE-2026-92823 was published Oct 21, 2026
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) Moderate
CVE-2026-96636 was published for Pillow (pip) Oct 22, 2026
mohammedix88 Credited to mohammedix88, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in... Moderate Unreviewed
CVE-2026-115396 was published Oct 22, 2026
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in... Moderate Unreviewed
CVE-2026-115503 was published Oct 22, 2026
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a... Moderate Unreviewed
CVE-2026-115638 was published Oct 23, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database