Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

165 advisories

Loading
Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory High
CVE-2026-118761 was published for github.com/kubeflow/pipelines (Go) Oct 30, 2026
bugbunny-research Credited to bugbunny-research
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566) Moderate
CVE-2026-116579 was published for autobahn (pip) Oct 28, 2026
adriank31 Credited to adriank31
Tanium addressed a compression bomb vulnerability in Enforce. High Unreviewed
CVE-2026-116662 was published Oct 27, 2026
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1... Moderate Unreviewed
CVE-2026-93850 was published Oct 26, 2026
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc... High Unreviewed
CVE-2026-97200 was published Oct 26, 2026
vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the... High Unreviewed
CVE-2026-116175 was published Oct 25, 2026
Echo: Decompress permits unbounded gzip expansion in v4 High
CVE-2026-118261 was published for github.com/labstack/echo/v4 (Go) Oct 23, 2026
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a... Moderate Unreviewed
CVE-2026-115638 was published Oct 23, 2026
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in... Moderate Unreviewed
CVE-2026-115503 was published Oct 22, 2026
Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in... Moderate Unreviewed
CVE-2026-115396 was published Oct 22, 2026
SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated... High Unreviewed
CVE-2026-113873 was published Oct 22, 2026
Django REST framework: JSONParser applies an attacker-named codec to the request stream High
CVE-2026-114136 was published for djangorestframework (pip) Oct 22, 2026
syrull Credited to syrull and jisung-02 jisung-02 jisung-02
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS High
CVE-2026-96637 was published for pillow (pip) Oct 22, 2026
sonicnew Credited to sonicnew, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek) Moderate
CVE-2026-96636 was published for Pillow (pip) Oct 22, 2026
mohammedix88 Credited to mohammedix88, radarhere, and hugovk radarhere radarhere
hugovk hugovk
Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox... High Unreviewed
CVE-2026-93471 was published Oct 22, 2026
Pillow: MSP RLE decoder expands a tiny file into unbounded memory High
CVE-2026-112892 was published for pillow (pip) Oct 21, 2026
MegaManSec Credited to MegaManSec, radarhere, and hugovk radarhere radarhere
hugovk hugovk
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML... Moderate Unreviewed
CVE-2026-92823 was published Oct 21, 2026
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all... High Unreviewed
CVE-2026-90797 was published Oct 20, 2026
Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated... High Unreviewed
CVE-2026-111924 was published Oct 17, 2026
In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0],... High Unreviewed
CVE-2026-102477 was published Oct 15, 2026
An Improper Handling of Highly Compressed Data vulnerability in the gRPC library used by na-grpcd... High Unreviewed
CVE-2026-102072 was published Oct 14, 2026
A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's... Moderate Unreviewed
CVE-2026-95502 was published Oct 13, 2026
The network messaging layer contained improper handling of highly compressed data affecting... High Unreviewed
CVE-2026-97334 was published Oct 13, 2026
Grav before 2.1.7 contains a denial of service vulnerability that allows authenticated media... High Unreviewed
CVE-2026-109324 was published Oct 12, 2026
Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the... High Unreviewed
CVE-2026-109398 was published Oct 12, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database
⌂ Proxy