Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

179 advisories

Loading
virtualenv: Downloaded wheel selection and caching precede verification Low
CVE-2026-113714 was published for virtualenv (pip) Oct 23, 2026
When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root... Low Unreviewed
CVE-2026-35501 was published Oct 21, 2026
Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. ... Moderate Unreviewed
CVE-2026-85243 was published Oct 19, 2026
Distribution: Client `manifests.Get()` does not verify returned content against requested digest Moderate
CVE-2026-85747 was published for github.com/distribution/distribution/v3 (Go) Oct 15, 2026
KrisKennawayDD Credited to KrisKennawayDD
Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip... Moderate Unreviewed
CVE-2026-109366 was published Oct 12, 2026
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org... High Unreviewed
CVE-2026-94447 was published Oct 9, 2026
Previously, a user operating inside of a malicious Go project that defines a bogus golang.org... High Unreviewed
CVE-2026-94444 was published Oct 9, 2026
Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially contain security... Moderate Unreviewed
CVE-2026-84900 was published Oct 5, 2026
In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parser accepted a... High Unreviewed
CVE-2026-71888 was published Oct 3, 2026
Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher)... High Unreviewed
CVE-2026-103601 was published Oct 2, 2026
Exposure of the message authentication key through the encryption keystream in the stream mode of... High Unreviewed
CVE-2026-16001 was published Oct 2, 2026
Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and... High Unreviewed
CVE-2026-15999 was published Oct 2, 2026
NetX Secure TLS accepts an empty application-data record without verifying its message... Moderate Unreviewed
CVE-2026-102759 was published Sep 29, 2026
The Tauri updater plugin verifies update binaries using minisign signatures, but the signature... Moderate Unreviewed
CVE-2026-95625 was published Sep 23, 2026
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who... High Unreviewed
CVE-2026-73459 was published Sep 16, 2026
Netcore NR268 firmware version 1.7.121109 has an improper integrity verification flaw in... High Unreviewed
CVE-2026-76852 was published Sep 16, 2026
Improper validation of integrity check value in Windows Installer allows an authorized attacker... High Unreviewed
CVE-2026-72929 was published Sep 8, 2026
Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption... Moderate Unreviewed
CVE-2026-20354 was published Sep 2, 2026
Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report... Critical Unreviewed
CVE-2026-75803 was published Aug 25, 2026
Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest... Critical Unreviewed
CVE-2026-75625 was published Aug 18, 2026
In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned... High Unreviewed
CVE-2026-12817 was published Aug 3, 2026
In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF... High Unreviewed
CVE-2026-12816 was published Aug 3, 2026
In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on... High Unreviewed
CVE-2026-12802 was published Aug 3, 2026
In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent... High Unreviewed
CVE-2026-12803 was published Aug 3, 2026
In Bouncy Castle for Java before 1.85, CCM-family modes write plaintext to caller buffer before... High Unreviewed
CVE-2026-58061 was published Aug 3, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database