Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,186
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,609
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

243 advisories

Loading
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words High
GHSA-f2hq-32vh-53cc was published for postal-mime (npm) Oct 23, 2026
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) High
CVE-2026-115585 was published for pypdf (pip) Oct 23, 2026
kyrux29 Credited to kyrux29, loegaire, and stefan6419846 loegaire loegaire
stefan6419846 stefan6419846
An attacker able to supply a crafted XML document to an application using QXmlStreamReader can... High Unreviewed
CVE-2026-16762 was published Oct 23, 2026
Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in... High Unreviewed
CVE-2026-115347 was published Oct 22, 2026
Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser... High Unreviewed
CVE-2026-115352 was published Oct 22, 2026
pypdf: Possible long runtimes/large memory usage when retrieving form fields Moderate
CVE-2026-113789 was published for pypdf (pip) Oct 22, 2026
adriank31 Credited to adriank31 and stefan6419846 stefan6419846 stefan6419846
toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() High
CVE-2026-114141 was published for toml (npm) Oct 22, 2026
pi3ch Credited to pi3ch
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() High
CVE-2026-114143 was published for toml (npm) Oct 22, 2026
pi3ch Credited to pi3ch, midnightmichigan, manus-pi, and devzephyr midnightmichigan midnightmichigan
manus-pi manus-pi devzephyr devzephyr
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule High
CVE-2026-75507 was published for graphql-core (pip) Oct 22, 2026
bcmyguest Credited to bcmyguest
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation High
CVE-2026-114138 was published for djangorestframework (pip) Oct 22, 2026
jisung-02 Credited to jisung-02
Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signing Moderate
CVE-2026-110871 was published for nodemailer (npm) Oct 22, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time High
CVE-2026-96643 was published for Pillow (pip) Oct 22, 2026
0xSmiley Credited to 0xSmiley and radarhere radarhere radarhere
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion High
CVE-2026-96640 was published for Pillow (pip) Oct 22, 2026
mfazrinizar Credited to mfazrinizar
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service Moderate
CVE-2026-114129 was published for stream-json (npm) Oct 22, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in... Low Unreviewed
CVE-2026-115319 was published Oct 22, 2026
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id) High
CVE-2026-112894 was published for Pillow (pip) Oct 21, 2026
Pillow: Quadratic GIF comment concatenation allows DoS in Image.open() Moderate
CVE-2026-112401 was published for Pillow (pip) Oct 21, 2026
Pillow: Quadratic GIF comment copying during save Moderate
CVE-2026-112891 was published for pillow (pip) Oct 21, 2026
iamibi Credited to iamibi
Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization High
CVE-2026-113729 was published for github.com/moov-io/signedxml (Go) Oct 21, 2026
shuji-oh Credited to shuji-oh
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in... High Unreviewed
CVE-2026-19630 was published Oct 21, 2026
markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) High
CVE-2026-111758 was published for markdown-it (npm) Oct 20, 2026
adriank31 Credited to adriank31
markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled Low
CVE-2026-111766 was published for markdown-it (npm) Oct 20, 2026
JarLob Credited to JarLob
markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes High
CVE-2026-111759 was published for markdown-it (npm) Oct 20, 2026
GSGFs7 Credited to GSGFs7
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating... Unknown Unreviewed
CVE-2026-110688 was published Oct 19, 2026
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed... High Unreviewed
CVE-2026-110755 was published Oct 17, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database