Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
64
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,236
pip
5,000+
Pub
14
RubyGems
1,213
Rust
1,627
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,595
Rust
25

37,813 advisories

Loading
Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes Moderate
CVE-2026-128077 was published for @nuxt/nitro-server (npm) Nov 13, 2026
kq5y Credited to kq5y
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http Moderate
CVE-2026-128080 was published for @opentelemetry/instrumentation-http (npm) Nov 13, 2026
klobucar Credited to klobucar
AutoMapper: Uncontrolled Recursion with Constructor Parameters High
CVE-2026-128082 was published for AutoMapper (NuGet) Nov 13, 2026
mcambria Credited to mcambria
russh kex_done: Shared-secret callback runs before server host-key verification Low
CVE-2026-128087 was published for russh (Rust) Nov 13, 2026
Yeaseen Credited to Yeaseen
russh try_sign: asynchronous confirmation can sign after agent lock Low
CVE-2026-128088 was published for russh (Rust) Nov 13, 2026
Yeaseen Credited to Yeaseen
OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification Moderate
CVE-2026-128086 was published for go.opentelemetry.io/otel/baggage (Go) Nov 13, 2026
alex131125 Credited to alex131125, pellared, and XSAM pellared pellared
XSAM XSAM
opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes Moderate
CVE-2026-128085 was published for go.opentelemetry.io/otel/sdk (Go) Nov 13, 2026
Hama1cco Credited to Hama1cco and pellared pellared pellared
sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger Moderate
CVE-2026-128084 was published for sqlite3 (RubyGems) Nov 13, 2026
luke-elttam Credited to luke-elttam
Laravel: Task Output Injection - Concurrency Process Low
CVE-2026-128083 was published for laravel/framework (Composer) Nov 13, 2026
Arr0way Credited to Arr0way
AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth High
CVE-2026-128081 was published for AutoMapper (NuGet) Nov 13, 2026
Astro: XSS via attribute injection in dynamic tag names Low
CVE-2026-126361 was published for astro (npm) Nov 13, 2026
uttej-badwane Credited to uttej-badwane
Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems Moderate
CVE-2026-126364 was published for @astrojs/node (npm) Nov 13, 2026
zachariah-mithani Credited to zachariah-mithani
Nuxt dev server serves files from a parent directory with a stray lockfile or workspace file Moderate
CVE-2026-128070 was published for @nuxt/schema (npm) Nov 13, 2026
superboy-zjc Credited to superboy-zjc
rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls Moderate
CVE-2026-128069 was published for rails-html-sanitizer (RubyGems) Nov 13, 2026
envd: Host file disclosure through requirements path traversal and TOCTOU Moderate
CVE-2026-128079 was published for envd (pip) Nov 13, 2026
SLRHR Credited to SLRHR
rails-html-sanitizer: Possible regular expression denial of service with certain configurations Moderate
CVE-2026-128068 was published for rails-html-sanitizer (RubyGems) Nov 13, 2026
OpenTelemetry Python API: Denial of service through quadratic-time traceparent parsing Moderate
CVE-2026-126360 was published for opentelemetry-api (pip) Nov 13, 2026
Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER High
CVE-2026-126191 was published for soupsieve (pip) Nov 13, 2026
Mucahic Credited to Mucahic
Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack Moderate
CVE-2026-126193 was published for soupsieve (pip) Nov 13, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens Critical
CVE-2026-100397 was published for rucio (pip) Nov 13, 2026
thebatou Credited to thebatou
Soup Sieve: Polynomial-time denial of service in the descendant combinator High
CVE-2026-126190 was published for soupsieve (pip) Nov 13, 2026
Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time Moderate
CVE-2026-126192 was published for soupsieve (pip) Nov 13, 2026
NotAFlightRisk Credited to NotAFlightRisk
Active Storage: Possible arbitrary file write and read in image analysis Critical
CVE-2026-122006 was published for activestorage (RubyGems) Nov 12, 2026
Ry0taK Credited to Ry0taK
Action Pack: Possible DoS vulnerability in Action Controller Live streaming Moderate
CVE-2026-126072 was published for actionpack (RubyGems) Nov 12, 2026
Action Pack: Possible sensitive session information leak in Active Storage proxy mode Moderate
CVE-2026-126077 was published for actionpack (RubyGems) Nov 12, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database
⌂