Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

15,963 advisories

Loading
PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL Moderate
CVE-2026-60090 was published for praisonai (pip) Oct 8, 2026
rexpository Credited to rexpository
Pydantic AI Web chat UI (`Agent.to_web()`, `clai web`): the local chat endpoint does not validate the `Host` header Moderate
CVE-2026-107292 was published for pydantic-ai (pip) Oct 8, 2026
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl Moderate
CVE-2026-107294 was published for pydantic-ai (pip) Oct 8, 2026
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) Moderate
CVE-2026-107228 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
1diot9 Credited to 1diot9
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS Moderate
CVE-2026-107226 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace Moderate
CVE-2026-61432 was published for praisonaiagents (pip) Oct 8, 2026
rexpository Credited to rexpository
Pydantic AI: Event loop blocked by quadratic title extraction in `web_fetch` Moderate
CVE-2026-107290 was published for pydantic-ai (pip) Oct 8, 2026
BrianWillows Credited to BrianWillows
Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers Moderate
CVE-2026-107289 was published for pydantic-ai (pip) Oct 8, 2026
euriconicacio Credited to euriconicacio
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments Moderate
CVE-2026-60087 was published for praisonaiagents (pip) Oct 8, 2026
SnailSploit Credited to SnailSploit
PraisonAI: Project config can auto-save agent output outside the project root Moderate
CVE-2026-60089 was published for praisonaiagents (pip) Oct 8, 2026
rexpository Credited to rexpository
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel Moderate
CVE-2026-107285 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk Moderate
CVE-2026-107280 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files Moderate
CVE-2026-61801 was published for github.com/moby/sys/user (Go) Oct 8, 2026
thaJeztah Credited to thaJeztah and kolyshkin kolyshkin kolyshkin
Ghost : Stored XSS via SVG Files in Content Imports Moderate
CVE-2026-105644 was published for ghost (npm) Oct 7, 2026
manus-pi Credited to manus-pi
Ghost: Regular Expression Denial of Service in External Media Inliner Moderate
CVE-2026-105645 was published for ghost (npm) Oct 7, 2026
ka3n1x Credited to ka3n1x
Ghost: Regular Expression Denial of Service in Content Import Moderate
CVE-2026-105646 was published for ghost (npm) Oct 7, 2026
ka3n1x Credited to ka3n1x
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS Moderate
CVE-2026-106121 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
NotAFlightRisk Credited to NotAFlightRisk
Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) Moderate
CVE-2026-105743 was published for docling (pip) Oct 7, 2026
DavidCarliez Credited to DavidCarliez and adelzaitri adelzaitri adelzaitri
Docling: Crafted DoclingDocument JSON embeds local image files into converted output Moderate
CVE-2026-105748 was published for docling (pip) Oct 7, 2026
wittjeff Credited to wittjeff
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion Moderate
CVE-2026-105749 was published for docling (pip) Oct 7, 2026
fpapaleq Credited to fpapaleq and wittjeff wittjeff wittjeff
Docling imports plugin entry points before the allow_external_plugins check Moderate
CVE-2026-105745 was published for docling (pip) Oct 7, 2026
hypnguyen1209 Credited to hypnguyen1209
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints Moderate
CVE-2026-105698 was published for langflow (pip) Oct 7, 2026
dhirajranka Credited to dhirajranka and andifilhohub andifilhohub andifilhohub
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs Moderate
CVE-2026-106450 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
Ghost: Server-Side Request Forgery in Bookmark Fetching Moderate
CVE-2026-105647 was published for ghost (npm) Oct 7, 2026
nhattanhh Credited to nhattanhh
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses Moderate
CVE-2026-105648 was published for ghost (npm) Oct 7, 2026
nhattanhh Credited to nhattanhh
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database