Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,847
Maven
5,000+
npm
5,000+
NuGet
1,131
pip
5,000+
Pub
13
RubyGems
1,158
Rust
1,579
Swift
63
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,513
Rust
20

96 advisories

Loading
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799) High
CVE-2026-63126 was published for com.squareup.wire:wire-runtime (Maven) Sep 17, 2026
thientd Credited to thientd and gladiator9797 gladiator9797 gladiator9797
nanoid: Integer Overflow or Wraparound High
CVE-2026-73086 was published for nanoid (npm) Sep 1, 2026
alanzabihi Credited to alanzabihi
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply High
CVE-2026-55764 was published for github.com/klever-io/klever-go (Go) Aug 28, 2026
nickgs1337 Credited to nickgs1337
Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability High
CVE-2026-62897 was published for Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Aug 11, 2026
Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability High
CVE-2026-62886 was published for Microsoft.WindowsDesktop.App.Runtime.win-arm64 (NuGet) Aug 11, 2026
frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow High
CVE-2026-73564 was published for github.com/fatedier/frp (Go) Jul 24, 2026
arkmarta Credited to arkmarta
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS High
CVE-2026-59879 was published for immutable (npm) Jul 21, 2026
mateuszismyname Credited to mateuszismyname, jdeniau, ravali-ch15, domcleal, LeongXuhua, and Ryan-Leber jdeniau jdeniau
ravali-ch15 ravali-ch15 domcleal domcleal LeongXuhua LeongXuhua Ryan-Leber Ryan-Leber
Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow High
CVE-2026-59199 was published for Pillow (pip) Jul 20, 2026
Serotav Credited to Serotav and radarhere radarhere radarhere
Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand` High
CVE-2026-59197 was published for Pillow (pip) Jul 20, 2026
Serotav Credited to Serotav and radarhere radarhere radarhere
jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow High
CVE-2026-52834 was published for jxl-grid (Rust) Jul 2, 2026
MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows High
CVE-2026-48502 was published for MessagePack (NuGet) Jun 25, 2026
AArnott Credited to AArnott
Oj: Integer Overflow in Oj.load 2GB String Handling High
CVE-2026-54903 was published for oj (RubyGems) Jun 19, 2026
Spring Framework Denial of Service via Integer Overflow in SpEL Expressions High
CVE-2026-41849 was published for org.springframework:spring-expression (Maven) Jun 9, 2026
GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function High
CVE-2026-37462 was published for github.com/osrg/gobgp/v4 (Go) Jun 3, 2026
OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI High
CVE-2026-45686 was published for go.opentelemetry.io/obi (Go) May 18, 2026
MrAlias Credited to MrAlias and grcevski grcevski grcevski
iskorotkov/avro: Integer Overflow in Decoder High
CVE-2026-46384 was published for github.com/iskorotkov/avro/v2 (Go) May 18, 2026
klajok Credited to klajok
smallbitvec: Integer overflow in safe API leads to heap buffer overflow High
CVE-2026-44983 was published for smallbitvec (Rust) May 9, 2026
ksj1230 Credited to ksj1230
Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow) High
CVE-2026-42311 was published for pillow (pip) May 4, 2026
EthanKim88 Credited to EthanKim88
Apache Thrift TFramedTransport Go language implementation has an Integer Overflow or Wraparound vulnerability High
CVE-2026-41602 was published for github.com/apache/thrift (Go) Apr 28, 2026
OpenEXR: DWA Lossy Decoder Heap Out-of-Bounds Write High
CVE-2026-34589 was published for OpenEXR (pip) Apr 8, 2026
quangIO Credited to quangIO
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write High
CVE-2026-34588 was published for OpenEXR (pip) Apr 8, 2026
quangIO Credited to quangIO
OpenEXR: integer overflow to OOB write in uncompress_b44_impl() High
CVE-2026-34544 was published for openexr (pip) Apr 3, 2026
nicoppida Credited to nicoppida
libp2p-gossipsub: Remote crash via unchecked Instant overflow in heartbeat backoff expiry handling High
CVE-2026-34219 was published for libp2p-gossipsub (Rust) Mar 30, 2026
NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead High
CVE-2026-27889 was published for github.com/nats-io/nats-server (Go) Mar 25, 2026
Mistz1 Credited to Mistz1 and jiayuqi7813 jiayuqi7813 jiayuqi7813
Gossipsub PRUNE.backoff Duration Overflow High
CVE-2026-33040 was published for libp2p-gossipsub (Rust) Mar 18, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database