Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,161
Rust
1,598
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

4 advisories

Loading
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS Moderate
CVE-2026-106121 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
NotAFlightRisk Credited to NotAFlightRisk
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line Moderate
GHSA-r4xh-jqrq-34v2 was published for smol-toml (npm) Oct 5, 2026
NotAFlightRisk Credited to NotAFlightRisk
stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunk Moderate
CVE-2026-104182 was published for stream-json (npm) Oct 5, 2026
NotAFlightRisk Credited to NotAFlightRisk
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds Moderate
GHSA-253c-mchw-3w2r was published for markdown-it (npm) Sep 29, 2026
NotAFlightRisk Credited to NotAFlightRisk and lissy93 lissy93 lissy93
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database