Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

253 advisories

Loading
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader... Moderate Unreviewed
CVE-2026-110263 was published Oct 14, 2026
OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter... Moderate Unreviewed
CVE-2026-110259 was published Oct 14, 2026
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder... Moderate Unreviewed
CVE-2026-109267 was published Oct 12, 2026
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG... Moderate Unreviewed
CVE-2026-109264 was published Oct 12, 2026
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0... Moderate Unreviewed
CVE-2026-19498 was published Oct 8, 2026
FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free()... Moderate Unreviewed
CVE-2026-107678 was published Oct 8, 2026
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion Moderate
CVE-2026-107833 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
oguzylmzx Credited to oguzylmzx
msgpack5: Deeply nested input can exhaust the decoder stack Moderate
CVE-2026-107298 was published for msgpack5 (npm) Oct 8, 2026
SWIFI-AI Credited to SWIFI-AI
ImageMagick before 7.1.2-30 and 6.9.13-55 contains an uncontrolled recursion vulnerability in the... Moderate Unreviewed
CVE-2026-105827 was published Oct 8, 2026
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled... Moderate Unreviewed
CVE-2026-44033 was published Oct 8, 2026
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS... Moderate Unreviewed
CVE-2026-44035 was published Oct 8, 2026
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper:... Moderate Unreviewed
CVE-2026-44036 was published Oct 8, 2026
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement(... Moderate Unreviewed
CVE-2026-44037 was published Oct 8, 2026
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially... Moderate Unreviewed
CVE-2026-103008 was published Oct 6, 2026
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially... Moderate Unreviewed
CVE-2026-103006 was published Oct 6, 2026
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low... Moderate Unreviewed
CVE-2026-102409 was published Oct 6, 2026
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values Moderate
GHSA-jggr-w7fw-pc2j was published for fast-copy (npm) Oct 5, 2026
lenny-ts Credited to lenny-ts
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header Moderate
CVE-2026-102265 was published for pyJWT (pip) Sep 29, 2026
Nivid42 Credited to Nivid42
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS Moderate
GHSA-8vvx-rff5-p5rq was published for nodemailer (npm) Sep 29, 2026
ry2811 Credited to ry2811
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS Moderate
CVE-2026-59168 was published for github.com/tomwright/dasel/v3 (Go) Sep 22, 2026
vmfunc Credited to vmfunc
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker... Moderate Unreviewed
CVE-2026-90472 was published Sep 12, 2026
A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used... Moderate Unreviewed
CVE-2026-88763 was published Sep 10, 2026
An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go... Moderate Unreviewed
CVE-2026-19201 was published Sep 9, 2026
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM... Moderate Unreviewed
CVE-2026-17440 was published Sep 4, 2026
A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an... Moderate Unreviewed
CVE-2026-14255 was published Sep 2, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database