Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
64
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,232
pip
5,000+
Pub
14
RubyGems
1,186
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,591
Rust
23

37,742 advisories

Loading
Forge: Certificate signature verified with the issuer's RSA signature scheme Low
CVE-2026-118774 was published for node-forge (npm) Nov 10, 2026
hibrian827 Credited to hibrian827
Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption Low
CVE-2026-118776 was published for node-forge (npm) Nov 10, 2026
zebbern Credited to zebbern, orenyomtov, and hibrian827 orenyomtov orenyomtov
hibrian827 hibrian827
Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage Moderate
CVE-2026-119189 was published for node-forge (npm) Nov 10, 2026
offset Credited to offset, zionboggan, and EchoSkorJjj zionboggan zionboggan
EchoSkorJjj EchoSkorJjj
Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer High
CVE-2026-119191 was published for node-forge (npm) Nov 10, 2026
arpitjain099 Credited to arpitjain099, Michael-JRead, and acorn421 Michael-JRead Michael-JRead
acorn421 acorn421
Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding High
CVE-2026-119192 was published for node-forge (npm) Nov 10, 2026
Brechard Credited to Brechard and orenyomtov orenyomtov orenyomtov
Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie() Moderate
CVE-2026-115779 was published for @effect/platform (npm) Nov 10, 2026
Zelys-DFKH Credited to Zelys-DFKH and tim-smart tim-smart tim-smart
OctoPrint: Stored XSS via saved connection parameters Low
CVE-2026-123364 was published for OctoPrint (pip) Nov 10, 2026
Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox Moderate
CVE-2026-110802 was published for altair-express-middleware (npm) Nov 10, 2026
whyn0x Credited to whyn0x
bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list Critical
CVE-2026-107846 was published for bitcoinjs-lib (npm) Nov 10, 2026
0xaudron Credited to 0xaudron, Ali-Kalout, landabaso, junderw, and Kvazar-ai Ali-Kalout Ali-Kalout
landabaso landabaso junderw junderw Kvazar-ai Kvazar-ai
compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env` Low
CVE-2026-123796 was published for compose-lint (GitHub Actions) Nov 10, 2026
GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover High
CVE-2026-103002 was published for gpustack (pip) Nov 10, 2026
xylove21 Credited to xylove21
AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution High
CVE-2026-113663 was published for ag2 (pip) Nov 10, 2026
elstati0n Credited to elstati0n
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover Critical
CVE-2026-102894 was published for gpustack (pip) Nov 10, 2026
Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API High
CVE-2026-102650 was published for @nuxt/content (npm) Nov 10, 2026
EQSTLab Credited to EQSTLab, knm6777, and Pig-Tail knm6777 knm6777
Pig-Tail Pig-Tail
compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output Low
CVE-2026-123373 was published for compose-lint (GitHub Actions) Nov 10, 2026
compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target Low
CVE-2026-123371 was published for compose-lint (GitHub Actions) Nov 10, 2026
compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings Low
CVE-2026-123372 was published for compose-lint (GitHub Actions) Nov 10, 2026
compose-lint: `fix --apply` can delete a line the user did not select, including a security setting Moderate
CVE-2026-123370 was published for compose-lint (pip) Nov 10, 2026
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action Moderate
CVE-2026-123369 was published for compose-lint (GitHub Actions) Nov 10, 2026
compose-lint: .env read through a symlink outside the project can expose the CI job's environment Low
CVE-2026-123368 was published for compose-lint (GitHub Actions) Nov 10, 2026
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks High
CVE-2026-119345 was published for github.com/ultravioletrs/cocos (Go) Nov 10, 2026
muhammad-usama-sardar Credited to muhammad-usama-sardar and SammyOina SammyOina SammyOina
node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions Critical
CVE-2026-95860 was published for node-opcua (npm) Nov 10, 2026
Velluso Credited to Velluso and erossignon erossignon erossignon
Dagu MCP DAG specification read bypasses path containment and workspace isolation Moderate
CVE-2026-102943 was published for github.com/dagu-org/dagu/v2 (Go) Nov 10, 2026
arpitjain099 Credited to arpitjain099
gopacket: SCTP chunk sub-decoder out-of-bounds panics on crafted segments Moderate
CVE-2026-119299 was published for github.com/gopacket/gopacket (Go) Nov 10, 2026
Reload3d Credited to Reload3d and FoxhoundAI FoxhoundAI FoxhoundAI
Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses Moderate
CVE-2026-88986 was published for github.com/kubeflow/pipelines (Go) Nov 9, 2026
pwny0 Credited to pwny0
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database