Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

24 advisories

Loading
Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization High
GHSA-hfwf-hgvp-4rr8 was published for vllm (pip) Oct 21, 2026 • withdrawn
Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write High
CVE-2026-105741 was published for langflow (pip) Oct 7, 2026
erichare Credited to erichare and andifilhohub andifilhohub andifilhohub
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing High
CVE-2026-61428 was published for praisonai (pip) Oct 7, 2026
dinhvaren Credited to dinhvaren
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard High
CVE-2026-102831 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
PyJWT: PyJWKClient follows redirects when fetching JWKS High
CVE-2026-102267 was published for PyJWT (pip) Sep 29, 2026
NovaHunter06 Credited to NovaHunter06
djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) High
CVE-2026-61591 was published for djust (pip) Sep 16, 2026
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots) High
CVE-2026-57122 was published for praisonai (pip) Jun 18, 2026
sour-exploit Credited to sour-exploit
PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals High
CVE-2026-56832 was published for praisonai (pip) Jun 18, 2026
rexpository Credited to rexpository
stigmem-node's federation peer token timestamp validation may reject valid peer tokens High
GHSA-xh5j-xjfq-qvvx was published for stigmem-node (pip) May 29, 2026
ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack High
CVE-2026-28500 was published for onnx (pip) Mar 16, 2026
ZeroXJacks Credited to ZeroXJacks
PyJWT accepts unknown `crit` header extensions High
CVE-2026-32597 was published for PyJWT (pip) Mar 13, 2026
dmbs335 Credited to dmbs335
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves High
CVE-2026-26007 was published for cryptography (pip) Feb 10, 2026
XlabAITeam Credited to XlabAITeam, tl2cents, keenanwgn, and A7um tl2cents tl2cents
keenanwgn keenanwgn A7um A7um
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass) High
CVE-2025-59420 was published for authlib (pip) Sep 22, 2025
AL-Cybision Credited to AL-Cybision
Picklescan is missing detection when calling pytorch function torch.utils._config_module.load_config High
CVE-2025-71348 was published for picklescan (pip) Aug 22, 2025
FredericDT Credited to FredericDT
Picklescan missing detection when calling pytorch function torch.jit.unsupported_tensor_ops.execWrapper High
CVE-2025-71370 was published for picklescan (pip) Aug 22, 2025
FredericDT Credited to FredericDT
Gradio lacks integrity checking on the downloaded FRP client High
CVE-2024-47867 was published for gradio (pip) Oct 10, 2024
ahpaleus Credited to ahpaleus and Vasco-jofra Vasco-jofra Vasco-jofra
vantage6-server node accepts non-whitelisted algorithms from malicious server High
CVE-2023-47631 was published for vantage6-node (pip) Nov 14, 2023
AsyncSSH Rogue Session Attack High
CVE-2023-46446 was published for asyncssh (pip) Nov 9, 2023
TrueSkrillor Credited to TrueSkrillor and lambdafu lambdafu lambdafu
Removal of e-Tugra root certificate High
CVE-2023-37920 was published for certifi (pip) Jul 25, 2023
crimsonknave Credited to crimsonknave
Incorrect header handling in mod-wsgi High
CVE-2022-2255 was published for mod-wsgi (pip) Aug 26, 2022
Openstack Neutron has Insufficient Verification of IPv6 addresses High
CVE-2021-20267 was published for neutron (pip) May 24, 2022
dnslib has DNS reply verification issue High
CVE-2022-22846 was published for dnslib (pip) Jan 12, 2022
Missing validation during checkpoint loading High
CVE-2021-41203 was published for tensorflow (pip) Nov 10, 2021
Ansible does not verify that the server hostname matches a domain name in certificates High
CVE-2015-3908 was published for ansible (pip) Oct 10, 2018
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database