Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,191
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,586
Rust
21

602 advisories

Loading
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c... High Unreviewed
CVE-2026-121968 was published Nov 4, 2026
NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist... Moderate Unreviewed
CVE-2026-65165 was published Nov 3, 2026
Several psqlODBC entry points use an application-supplied column number or row index as an array... High Unreviewed
CVE-2026-120064 was published Nov 2, 2026
A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain... Low Unreviewed
CVE-2026-107457 was published Nov 2, 2026
Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability... Moderate Unreviewed
CVE-2026-119143 was published Oct 29, 2026
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) Moderate
CVE-2026-115916 was published for vllm (pip) Oct 28, 2026
shijie-lyu Credited to shijie-lyu and jperezdealgaba jperezdealgaba jperezdealgaba
Go JOSE: Panic during CBC-HMAC processing Moderate
CVE-2026-116585 was published for github.com/go-jose/go-jose/v3 (Go) Oct 28, 2026
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite Moderate
CVE-2026-116590 was published for org.xerial.snappy:snappy-java (Maven) Oct 27, 2026
llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in... High Unreviewed
CVE-2026-116816 was published Oct 27, 2026
llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and... High Unreviewed
CVE-2024-58400 was published Oct 27, 2026
Furnace through 0.6.8.3 contains an out-of-bounds write vulnerability in DivEngine::loadFTM()... Moderate Unreviewed
CVE-2026-116731 was published Oct 27, 2026
vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows... High Unreviewed
CVE-2026-116181 was published Oct 25, 2026
RPly through 1.1.4 contains an improper array index validation vulnerability in... Moderate Unreviewed
CVE-2026-115722 was published Oct 23, 2026
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer:... High Unreviewed
CVE-2026-114405 was published Oct 21, 2026
The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without... Moderate Unreviewed
CVE-2026-103672 was published Oct 20, 2026
SFTPGo: Denial of service via malformed SSH channel request Moderate
CVE-2026-77375 was published for github.com/drakkan/sftpgo/v2 (Go) Oct 15, 2026
arnimar Credited to arnimar
Improper validation of array index vulnerability in Samsung Open Source Vyond allows Input Data... Moderate Unreviewed
CVE-2026-110934 was published Oct 15, 2026
FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that... High Unreviewed
CVE-2026-109250 was published Oct 12, 2026
FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an... Moderate Unreviewed
CVE-2026-109251 was published Oct 12, 2026
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate... Moderate Unreviewed
CVE-2026-103220 was published Oct 9, 2026
Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds... High Unreviewed
CVE-2026-107325 was published Oct 8, 2026
Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic High
CVE-2026-107211 was published for github.com/xuri/excelize/v2 (Go) Oct 8, 2026
White0xdi3 Credited to White0xdi3
Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" rows High
CVE-2026-107217 was published for github.com/xuri/excelize (Go) Oct 7, 2026
lmonstergg Credited to lmonstergg
Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics Moderate
CVE-2026-107218 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref Moderate
CVE-2026-107220 was published for github.com/xuri/excelize/v2 (Go) Oct 7, 2026
arpitjain099 Credited to arpitjain099
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database