Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

2,606 advisories

Loading
vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank` Moderate
CVE-2026-105755 was published for vllm (pip) Oct 5, 2026
KernelClint Credited to KernelClint, dhalf, and jperezdealgaba dhalf dhalf
jperezdealgaba jperezdealgaba
vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service Moderate
CVE-2026-105756 was published for vllm (pip) Oct 5, 2026
KernelClint Credited to KernelClint, dhalf, and jperezdealgaba dhalf dhalf
jperezdealgaba jperezdealgaba
uv: Path traversal on Windows through wheel extraction Moderate
CVE-2026-104843 was published for uv (pip) Oct 5, 2026
woodruffw Credited to woodruffw, charliermarsh, and White0xdi3 charliermarsh charliermarsh
White0xdi3 White0xdi3
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup Moderate
CVE-2026-102991 was published for Mako (pip) Oct 5, 2026
euriconicacio Credited to euriconicacio
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction Moderate
CVE-2026-104874 was published for multidict (pip) Oct 5, 2026
waydeshi Credited to waydeshi
pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methods Moderate
CVE-2026-88029 was published for pymongo (pip) Oct 5, 2026
Snowflake drivers writes sensitive information to logs Moderate
CVE-2026-86597 was published for github.com/snowflakedb/gosnowflake (Go) Oct 5, 2026
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend Moderate
CVE-2026-105751 was published for docling (pip) Oct 5, 2026
arexgodofwar Credited to arexgodofwar
geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point Moderate
CVE-2026-77387 was published for geopy (pip) Oct 2, 2026
gnsehfvlr Credited to gnsehfvlr, apoorvdarshan, and KostyaEsmukov apoorvdarshan apoorvdarshan
KostyaEsmukov KostyaEsmukov
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution Moderate
GHSA-35mr-4567-66vg was published for dulwich (pip) Oct 2, 2026
LukeBanto Credited to LukeBanto
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) Moderate
CVE-2026-102830 was published for jupyterlab (pip) Oct 1, 2026
mingijunggrape Credited to mingijunggrape, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs Moderate
CVE-2026-102904 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection Moderate
CVE-2026-102938 was published for virtualenv (pip) Sep 30, 2026
gaborbernat Credited to gaborbernat
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse Moderate
CVE-2026-103001 was published for PyJWT (pip) Sep 30, 2026
tritsystem Credited to tritsystem
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS Moderate
GHSA-3hv7-mjh2-fv65 was published for tornado (pip) Sep 30, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team and manus-pi manus-pi manus-pi
GitPython submodule update path traversal can write outside the repository Moderate
GHSA-59cr-6r3x-644w was published for GitPython (pip) Sep 30, 2026
kta1kri Credited to kta1kri
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle Moderate
GHSA-whh4-5q6c-9v3x was published for gitpython (pip) Sep 30, 2026
kokomaru167 Credited to kokomaru167
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters Moderate
CVE-2026-84377 was published for litellm (pip) Sep 30, 2026
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) Moderate
CVE-2026-101918 was published for PyJWT (pip) Sep 30, 2026
not-ekalabya Credited to not-ekalabya
urllib3: Chunked Deflate streaming can enter an infinite loop Moderate
CVE-2026-97688 was published for urllib3 (pip) Sep 30, 2026
gnuletik Credited to gnuletik, illia-v, and pquentin illia-v illia-v
pquentin pquentin
PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. Moderate
CVE-2026-102270 was published for pyjwt (pip) Sep 30, 2026
Yanni8 Credited to Yanni8
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header Moderate
CVE-2026-102265 was published for pyJWT (pip) Sep 29, 2026
Nivid42 Credited to Nivid42
PyJWT: Non-canonical signature segments enable raw-token revocation bypass Moderate
CVE-2026-102269 was published for PyJWT (pip) Sep 29, 2026
ze3tar Credited to ze3tar
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) Moderate
CVE-2026-101917 was published for pyjwt (pip) Sep 29, 2026
babakizo420 Credited to babakizo420
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set Moderate
CVE-2026-102274 was published for PyJWT (pip) Sep 29, 2026
pi3ch Credited to pi3ch
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database