Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
121
GitHub Actions
56
Go
4,970
Maven
5,000+
npm
5,000+
NuGet
1,185
pip
5,000+
Pub
13
RubyGems
1,161
Rust
1,595
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,579
Rust
21

191 advisories

Loading
Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability High
CVE-2026-58280 was published for Microsoft.NETCore.App.Runtime.linux-arm (NuGet) Oct 13, 2026
Vikunja: Unbounded nested task-filter recursion permits API process termination High
CVE-2026-91968 was published for code.vikunja.io/api (Go) Oct 9, 2026
Zyy0530 Credited to Zyy0530, Str1ckl4nd, and 7thParkk Str1ckl4nd Str1ckl4nd
7thParkk 7thParkk
Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion Moderate
CVE-2026-107833 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
oguzylmzx Credited to oguzylmzx
Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) High
CVE-2026-107826 was published for github.com/corazawaf/coraza/v3 (Go) Oct 8, 2026
msgpack5: Many buffered values can exhaust the streaming decoder stack High
CVE-2026-107300 was published for msgpack5 (npm) Oct 8, 2026
SWIFI-AI Credited to SWIFI-AI
msgpack5: Deeply nested input can exhaust the decoder stack Moderate
CVE-2026-107298 was published for msgpack5 (npm) Oct 8, 2026
SWIFI-AI Credited to SWIFI-AI
Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow High
CVE-2026-107216 was published for github.com/xuri/excelize/v2 (Go) Oct 8, 2026
lmonstergg Credited to lmonstergg
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError Low
CVE-2026-106449 was published for at.yawk.lz4:lz4-java (Maven) Oct 7, 2026
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values Moderate
GHSA-jggr-w7fw-pc2j was published for fast-copy (npm) Oct 5, 2026
lenny-ts Credited to lenny-ts
aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers High
CVE-2026-18140 was published for aws-smithy-json (Rust) Oct 2, 2026
Nest: Remote process termination via a deeply nested microservice message pattern High
CVE-2026-102281 was published for @nestjs/microservices (npm) Sep 29, 2026
zerovulnlabs Credited to zerovulnlabs
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion High
CVE-2026-102278 was published for brace-expansion (npm) Sep 29, 2026
G-Rath Credited to G-Rath and katzj katzj katzj
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion High
CVE-2026-102276 was published for brace-expansion (npm) Sep 29, 2026
baeseungwon1010 Credited to baeseungwon1010, katzj, and G-Rath katzj katzj
G-Rath G-Rath
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header Moderate
CVE-2026-102265 was published for pyJWT (pip) Sep 29, 2026
Nivid42 Credited to Nivid42
Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS Moderate
GHSA-8vvx-rff5-p5rq was published for nodemailer (npm) Sep 29, 2026
ry2811 Credited to ry2811
Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS Moderate
CVE-2026-59168 was published for github.com/tomwright/dasel/v3 (Go) Sep 22, 2026
vmfunc Credited to vmfunc
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns High
CVE-2026-93687 was published for braces (npm) Sep 18, 2026
Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination High
GHSA-jfw3-2gcf-23r5 was published for code.vikunja.io/api (Go) Sep 15, 2026 • withdrawn
toml-node: Uncontrolled Recursion High
CVE-2026-77465 was published for toml (npm) Sep 3, 2026
seok-hee97 Credited to seok-hee97
Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown High
CVE-2026-76098 was published for mistune (pip) Sep 2, 2026
wan1yan Credited to wan1yan
NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars Moderate
CVE-2026-12876 was published for nltk (pip) Sep 2, 2026
NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input Moderate
CVE-2026-81724 was published for nltk (pip) Sep 2, 2026
JoshgunAbdullayev Credited to JoshgunAbdullayev
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption Low
CVE-2026-55588 was published for oras.land/oras (Go) Aug 28, 2026
aditya19200 Credited to aditya19200
Duplicate Advisory: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input Moderate
GHSA-pf76-q698-37v8 was published for nltk (pip) Aug 27, 2026 • withdrawn
django CMS: Plugin move endpoint allows cyclic reparenting (DoS) High
CVE-2026-54623 was published for django-cms (pip) Aug 24, 2026
Zyy0530 Credited to Zyy0530, Str1ckl4nd, 7thParkk, and mauriceng98 Str1ckl4nd Str1ckl4nd
7thParkk 7thParkk mauriceng98 mauriceng98
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database