Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,475
Maven
5,000+
npm
5,000+
NuGet
1,091
pip
5,000+
Pub
13
RubyGems
1,144
Rust
1,510
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

172 advisories

Loading
Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware High
GHSA-mqxv-9rm6-w8qc was published for github.com/lin-snow/ech0 (Go) Jul 14, 2026
tonghuaroot Credited to tonghuaroot
Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator High
CVE-2026-48006 was published for io.netty:netty-codec-redis (Maven) Jun 11, 2026
When the BIG-IP Configuration utility is configured to use Lightweight Directory Access Protocol ... High Unreviewed
CVE-2026-39455 was published May 13, 2026
An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS... High Unreviewed
CVE-2026-35227 was published May 12, 2026
Netty epoll transport denial of service via RST on half-closed TCP connection High
CVE-2026-42577 was published for io.netty:netty-transport-classes-epoll (Maven) May 6, 2026
Stormpx Credited to Stormpx, dzaisban, normanmaurer, SeBBBe, pjfanning, jneira-stratio, mpenttila, chrisvest, and tal-sealsecurity dzaisban dzaisban
normanmaurer normanmaurer SeBBBe SeBBBe pjfanning pjfanning jneira-stratio jneira-stratio mpenttila mpenttila chrisvest chrisvest tal-sealsecurity tal-sealsecurity
A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by... High Unreviewed
CVE-2026-3104 was published Mar 25, 2026
Due to a programming error, blocklistd leaks a socket descriptor for each adverse event report it... High Unreviewed
CVE-2026-2261 was published Mar 9, 2026
A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall... High Unreviewed
CVE-2026-20082 was published Mar 4, 2026
Multer vulnerable to Denial of Service via resource exhaustion High
CVE-2026-2359 was published for multer (npm) Mar 1, 2026
ctcpip Credited to ctcpip, nawin23, UlisesGascon, sheplu, and bjohansebas nawin23 nawin23
UlisesGascon UlisesGascon sheplu sheplu bjohansebas bjohansebas
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: cancel... High Unreviewed
CVE-2026-23185 was published Feb 14, 2026
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image. If the... High Unreviewed
CVE-2026-21720 was published Jan 27, 2026
thread-amount Vulnerable to Resource Exhaustion (Memory and Handle Leaks) on Windows and macOS High
CVE-2025-65947 was published for thread-amount (Rust) Nov 21, 2025
jzeuzs Credited to jzeuzs
IBM MQ 9.1, 9.2, 9.3, 9.4 LTS and 9.3, 9.4 CD is vulnerable to a denial of service, caused by... High Unreviewed
CVE-2025-36128 was published Oct 16, 2025
A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5... High Unreviewed
CVE-2025-30256 was published Aug 20, 2025
In the Linux kernel, the following vulnerability has been resolved: tools/power turbostat: Fix... High Unreviewed
CVE-2022-50189 was published Jun 18, 2025
Goroutine Leak in Abacus SSE Implementation High
CVE-2025-27421 was published for github.com/jasonlovesdoggo/abacus (Go) Mar 3, 2025
JasonLovesDoggo Credited to JasonLovesDoggo
When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint... High Unreviewed
CVE-2025-22891 was published Feb 5, 2025
This issue was addressed by improved management of object lifetimes. This issue is fixed in macOS... High Unreviewed
CVE-2025-24120 was published Jan 28, 2025
An authenticated user can provide a malformed ACL to the fileserver's StoreACL RPC, causing the... High Unreviewed
CVE-2024-10396 was published Nov 14, 2024
Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion High
CVE-2024-49769 was published for waitress (pip) Oct 29, 2024
djay Credited to djay, d-maurer, and digitalresistor d-maurer d-maurer
digitalresistor digitalresistor
A Missing Release of Resource after Effective Lifetime vulnerability the xinetd process,... High Unreviewed
CVE-2024-39562 was published Jul 11, 2024
In the Linux kernel, the following vulnerability has been resolved: ubifs: Set page uptodate in... High Unreviewed
CVE-2024-35821 was published May 17, 2024
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of... High Unreviewed
CVE-2024-2398 was published Mar 27, 2024
When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed... High Unreviewed
CVE-2024-21789 was published Feb 14, 2024
Etcd Gateway can include itself as an endpoint resulting in resource exhaustion High
CVE-2020-15114 was published for go.etcd.io/etcd (Go) Jan 31, 2024
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database