Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,143
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,555
Rust
21

34 advisories

Loading
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session High
GHSA-jq7h-wrvp-3rgx was published for pyload-ng (pip) Oct 9, 2026
arpitjain099 Credited to arpitjain099
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up High
CVE-2026-107813 was published for github.com/0xJacky/Nginx-UI (Go) Oct 9, 2026
arpitjain099 Credited to arpitjain099
Indico: Missing access check in legacy session export API Moderate
CVE-2026-107395 was published for indico (pip) Oct 8, 2026
arpitjain099 Credited to arpitjain099
music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abort Moderate
CVE-2026-107389 was published for music-metadata (npm) Oct 8, 2026
bg0d-glitch Credited to bg0d-glitch, Zwique, offset, and arpitjain099 Zwique Zwique
offset offset arpitjain099 arpitjain099
svg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferences Moderate
CVE-2026-107381 was published for enshrined/svg-sanitize (Composer) Oct 8, 2026
arpitjain099 Credited to arpitjain099
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics Moderate
CVE-2026-107218 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile High
CVE-2026-107219 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref Moderate
CVE-2026-107220 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read API Moderate
CVE-2026-107221 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check Moderate
CVE-2026-107222 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process High
CVE-2026-107223 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader Moderate
CVE-2026-107224 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml Moderate
CVE-2026-107225 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError Moderate
CVE-2026-106453 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path Moderate
CVE-2026-59944 was published for composer/composer (Composer) Oct 2, 2026
DavidCarliez Credited to DavidCarliez, manus-use, and arpitjain099 manus-use manus-use
arpitjain099 arpitjain099
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted Moderate
CVE-2026-92945 was published for vm2 (npm) Oct 1, 2026
arpitjain099 Credited to arpitjain099
Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange Moderate
CVE-2026-102824 was published for russh (Rust) Sep 30, 2026
arpitjain099 Credited to arpitjain099
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path Low
CVE-2026-102825 was published for russh (Rust) Sep 30, 2026
arpitjain099 Credited to arpitjain099
Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files Moderate
CVE-2026-92164 was published for streamlink (pip) Sep 24, 2026
arpitjain099 Credited to arpitjain099 and bastimeyer bastimeyer bastimeyer
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354) Moderate
GHSA-9rcc-pmj8-ffhr was published for mediawiki/semantic-media-wiki (Composer) Sep 18, 2026
arpitjain099 Credited to arpitjain099
Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write Critical
CVE-2026-75827 was published for getgrav/grav (Composer) Sep 17, 2026
arpitjain099 Credited to arpitjain099
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS Critical
CVE-2026-75828 was published for getgrav/grav (Composer) Sep 17, 2026
arpitjain099 Credited to arpitjain099
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets Moderate
CVE-2026-88001 was published for open-webui (pip) Sep 9, 2026
arpitjain099 Credited to arpitjain099 and Classic298 Classic298 Classic298
multer vulnerable to Denial of Service via oversized array index in field names High
CVE-2026-82333 was published for multer (npm) Sep 8, 2026
O4FDev Credited to O4FDev, UlisesGascon, and arpitjain099 UlisesGascon UlisesGascon
arpitjain099 arpitjain099
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed High
CVE-2026-83616 was published for @xmldom/xmldom (npm) Sep 8, 2026
bhaswanthc Credited to bhaswanthc and arpitjain099 arpitjain099 arpitjain099
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database