Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,603
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

158 advisories

Loading
HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification) High
CVE-2026-84382 was published for httpx2 (pip) Sep 8, 2026
tawAsh1 Credited to tawAsh1
Duplicate Advisory: Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability Moderate
GHSA-v3f6-m9j2-437p was published for Microsoft.AspNetCore.Server.IISIntegration (NuGet) Sep 8, 2026 • withdrawn
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... High Unreviewed
CVE-2026-79695 was published Sep 9, 2026
Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability Moderate
CVE-2026-69304 was published for Microsoft.AspNetCore.Server.IISIntegration (NuGet) Sep 9, 2026
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription... High Unreviewed
CVE-2026-90555 was published Sep 12, 2026
Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by... Moderate Unreviewed
CVE-2026-89321 was published Sep 14, 2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22... Moderate Unreviewed
CVE-2026-5132 was published Sep 14, 2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22... Moderate Unreviewed
CVE-2026-15814 was published Sep 14, 2026
adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP... High Unreviewed
CVE-2026-92000 was published Sep 15, 2026
Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip() Moderate
CVE-2026-59193 was published for getgrav/grav (Composer) Sep 16, 2026
Scriptmagum Credited to Scriptmagum
Duplicate Advisory: Grav: Decompression-bomb size cap bypassed by forged ZIP size in ZipArchiver/Installer High
GHSA-v626-428r-43p8 was published for getgrav/grav (Composer) Jul 15, 2026 • withdrawn
AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service High
CVE-2026-85721 was published for org.asynchttpclient:async-http-client (Maven) Sep 17, 2026
hyperxpro Credited to hyperxpro
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service High
CVE-2026-81875 was published for ca.uhn.hapi.fhir:org.hl7.fhir.r5 (Maven) Sep 17, 2026
sondt99 Credited to sondt99
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API... High Unreviewed
CVE-2026-70469 was published Sep 16, 2026
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37,... Moderate Unreviewed
CVE-2026-77021 was published Sep 21, 2026
The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we... High Unreviewed
CVE-2026-47321 was published Sep 21, 2026
Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation Moderate
CVE-2026-77528 was published for autobahn (pip) Sep 22, 2026
hibrian827 Credited to hibrian827
A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate... High Unreviewed
CVE-2026-15709 was published Jul 14, 2026
Improper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1... Moderate Unreviewed
CVE-2026-92573 was published Sep 25, 2026
urllib3 streaming API improperly handles highly compressed data High
CVE-2025-66471 was published for urllib3 (pip) Dec 5, 2025
illia-v Credited to illia-v, pquentin, sethmlarson, Cycloctane, stamparm, and Chi-Song-Owen pquentin pquentin
sethmlarson sethmlarson Cycloctane Cycloctane stamparm stamparm Chi-Song-Owen Chi-Song-Owen
adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0 High
GHSA-rcw4-f5rp-g42v was published for adm-zip (npm) Sep 29, 2026
dilipk5 Credited to dilipk5
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM High
GHSA-chx6-46f5-w4vp was published for tornado (pip) Sep 30, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team and aoto-tech aoto-tech aoto-tech
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in... High Unreviewed
CVE-2026-103262 was published Oct 1, 2026
devalue: Repeated primitive strings cause quadratic expansion in uneval High
GHSA-mcm9-63f2-9j32 was published for devalue (npm) Oct 1, 2026
elliott-with-the-longest-name-on-github Credited to elliott-with-the-longest-name-on-github
Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift... High Unreviewed
CVE-2026-94637 was published Oct 2, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database