Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

7,185 advisories

Loading
OmniFaces: Forged combined-resource IDs and related output/push boundaries High
CVE-2026-102695 was published for org.omnifaces:omnifaces (Maven) Jul 24, 2026
OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl High
CVE-2026-54641 was published for io.openremote:openremote-manager (Maven) Jul 6, 2026
geo-chen Credited to geo-chen
Hazelcast allows arbitrary member memory access by low-privileged client Critical
CVE-2026-107726 was published for com.hazelcast:hazelcast (Maven) Oct 8, 2026
k-jamroz Credited to k-jamroz
Hazelcast has an authorization bypass in IMap Predicates API High
CVE-2026-107725 was published for com.hazelcast:hazelcast (Maven) Oct 8, 2026
k-jamroz Credited to k-jamroz
AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix) Moderate
CVE-2026-107228 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
1diot9 Credited to 1diot9
AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS Moderate
CVE-2026-107226 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled High
CVE-2026-107227 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins High
CVE-2026-107230 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random source Low
CVE-2026-107283 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel Moderate
CVE-2026-107285 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk Moderate
CVE-2026-107280 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host Critical
CVE-2026-107282 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext High
CVE-2026-107231 was published for org.asynchttpclient:async-http-client (Maven) Oct 8, 2026
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS Moderate
CVE-2026-106121 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
NotAFlightRisk Credited to NotAFlightRisk
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user High
CVE-2026-106451 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError Low
CVE-2026-106449 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs Moderate
CVE-2026-106450 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers Moderate
CVE-2026-106122 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
ba-am Credited to ba-am
jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input High
CVE-2026-84218 was published for org.jolokia:jolokia-service-jsr160 (Maven) Sep 1, 2026
grgrzybek Credited to grgrzybek and ByteHackr ByteHackr ByteHackr
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() Moderate
CVE-2026-106123 was published for com.rabbitmq:amqp-client (Maven) Oct 7, 2026
sonicnew Credited to sonicnew
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header Moderate
CVE-2026-106452 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
yawkat Credited to yawkat
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError Moderate
CVE-2026-106453 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints Critical
CVE-2026-47892 was published for org.springframework:spring-webflux (Maven) Aug 27, 2026
Spring Framework Server Sent Event stream corruption while rendering fragments Critical
CVE-2026-47890 was published for org.springframework:spring-webflux (Maven) Aug 27, 2026
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion Moderate
CVE-2026-48043 was published for io.netty:netty-codec-http2 (Maven) Jun 11, 2026
tayfuryldz Credited to tayfuryldz and stanleys12 stanleys12 stanleys12
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database