Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

6,568 advisories

Loading
Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description High
GHSA-qqw9-2vj9-hx7r was published for langflow (pip) Oct 2, 2026 • withdrawn
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json) Moderate
CVE-2026-102830 was published for jupyterlab (pip) Oct 1, 2026
mingijunggrape Credited to mingijunggrape, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs Moderate
CVE-2026-102904 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard High
CVE-2026-102831 was published for jupyterlab (pip) Oct 1, 2026
rexpository Credited to rexpository, MUFFANUJ, and krassowski MUFFANUJ MUFFANUJ
krassowski krassowski
virtualenv bash and fish activation scripts execute commands embedded in paths High
CVE-2026-102925 was published for virtualenv (pip) Oct 1, 2026
gaborbernat Credited to gaborbernat
virtualenv: Command injection via --prompt in activate.bat (batch activator) High
CVE-2026-102937 was published for virtualenv (pip) Oct 1, 2026
gaborbernat Credited to gaborbernat
pypdf: Possible long runtimes with large amount of embedded files High
CVE-2026-102999 was published for pypdf (pip) Oct 1, 2026
jungmingi-lab Credited to jungmingi-lab
pypdf: Possible long runtimes when generating appearance streams High
CVE-2026-102998 was published for pypdf (pip) Oct 1, 2026
manop55555 Credited to manop55555
pypdf: Possible large memory usage when retrieving alphabetical page labels High
CVE-2026-103000 was published for pypdf (pip) Oct 1, 2026
manop55555 Credited to manop55555 and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up) High
CVE-2026-102997 was published for pypdf (pip) Oct 1, 2026
geoffrey-diederichs Credited to geoffrey-diederichs and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible large memory usage when parsing font data High
CVE-2026-102996 was published for pypdf (pip) Oct 1, 2026
jungmingi-lab Credited to jungmingi-lab and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2) High
CVE-2026-102995 was published for pypdf (pip) Oct 1, 2026
jungmingi-lab Credited to jungmingi-lab and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible long runtimes/large memory usage when parsing indirect objects High
CVE-2026-102994 was published for pypdf (pip) Oct 1, 2026
jankesec Credited to jankesec and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible large memory usage when retrieving Roman page labels High
CVE-2026-102993 was published for pypdf (pip) Oct 1, 2026
Nivid42 Credited to Nivid42 and stefan6419846 stefan6419846 stefan6419846
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use High
CVE-2026-102930 was published for virtualenv (pip) Sep 30, 2026
gaborbernat Credited to gaborbernat
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection Moderate
CVE-2026-102938 was published for virtualenv (pip) Sep 30, 2026
gaborbernat Credited to gaborbernat
PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse Moderate
CVE-2026-103001 was published for PyJWT (pip) Sep 30, 2026
tritsystem Credited to tritsystem
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS Moderate
GHSA-3hv7-mjh2-fv65 was published for tornado (pip) Sep 30, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team and manus-pi manus-pi manus-pi
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM High
GHSA-chx6-46f5-w4vp was published for tornado (pip) Sep 30, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team and aoto-tech aoto-tech aoto-tech
Tornado: StaticFileHandler follows symlinks outside static root (path traversal) High
GHSA-c2m8-h5v5-343r was published for tornado (pip) Sep 30, 2026
Yasha-ops Credited to Yasha-ops and iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team iaohkut-from-NightWolf-Team
GitPython submodule update path traversal can write outside the repository Moderate
GHSA-59cr-6r3x-644w was published for GitPython (pip) Sep 30, 2026
kta1kri Credited to kta1kri
GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing High
CVE-2026-87819 was published for GitPython (pip) Sep 30, 2026
prvazsahnazarov Credited to prvazsahnazarov and manus-use manus-use manus-use
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle Moderate
GHSA-whh4-5q6c-9v3x was published for gitpython (pip) Sep 30, 2026
kokomaru167 Credited to kokomaru167
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution High
CVE-2026-87817 was published for gitpython (pip) Sep 30, 2026
dharanivarma Credited to dharanivarma
LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters Moderate
CVE-2026-84377 was published for litellm (pip) Sep 30, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database