GitHub Advisory Database · GitHub
Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
56
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,187
pip
5,000+
Pub
14
RubyGems
1,162
Rust
1,613
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,580
Rust
21

37,320 advisories

Loading
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source High
CVE-2026-116690 was published for mlflow (pip) Oct 27, 2026
mskca Credited to mskca
MLflow CrewAI autologging records LLM provider API keys in logged trace spans Moderate
CVE-2026-116691 was published for mlflow (pip) Oct 27, 2026
IdoGol24 Credited to IdoGol24
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules Critical
CVE-2026-116692 was published for mlflow (pip) Oct 27, 2026
mskca Credited to mskca
dd-trace: ReDOS in URL query string obfuscation High
CVE-2026-116693 was published for dd-trace (npm) Oct 27, 2026
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization High
CVE-2026-116675 was published for TinyMCE (Composer) Oct 27, 2026
farisv Credited to farisv and secalert secalert secalert
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server Moderate
CVE-2026-116684 was published for mcp (pip) Oct 27, 2026
u-ktdi Credited to u-ktdi
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation Moderate
CVE-2026-116694 was published for opentelemetry-propagator-jaeger (pip) Oct 27, 2026
tonghuaroot Credited to tonghuaroot
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies Moderate
CVE-2026-116685 was published for mcp (pip) Oct 27, 2026
dodge1218 Credited to dodge1218 and nickelsec nickelsec nickelsec
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas Moderate
CVE-2026-116686 was published for mcp (pip) Oct 27, 2026
Hem1700 Credited to Hem1700
CKEditor: Cross-site scripting (XSS) in the engine package Low
CVE-2026-116687 was published for @ckeditor/ckeditor5-engine (npm) Oct 27, 2026
CKEditor: Cross-site scripting (XSS) in the engine package High
CVE-2026-116688 was published for @ckeditor/ckeditor5-engine (npm) Oct 27, 2026
Neko: Authorization bypass in legacy WebRTC input handling Moderate
CVE-2026-116679 was published for github.com/m1k1o/neko/server (Go) Oct 27, 2026
KasperBuilds Credited to KasperBuilds
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan High
CVE-2026-116676 was published for github.com/runatlantis/atlantis (Go) Oct 27, 2026
krewenki Credited to krewenki
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory High
CVE-2026-116682 was published for github.com/gtsteffaniak/filebrowser/backend (Go) Oct 27, 2026
je-lv Credited to je-lv and KasperBuilds KasperBuilds KasperBuilds
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects High
CVE-2026-109829 was published for undici (npm) Oct 27, 2026
Kushalkhemka Credited to Kushalkhemka, mayank-jangid-moon, skigeek16, opensec-intelligence, bengsky13, mcollina, and UlisesGascon mayank-jangid-moon mayank-jangid-moon
skigeek16 skigeek16 opensec-intelligence opensec-intelligence bengsky13 bengsky13 mcollina mcollina UlisesGascon UlisesGascon
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent High
CVE-2026-109383 was published for undici (npm) Oct 27, 2026
euriconicacio Credited to euriconicacio, BlueN0r, ksanjeev284, mcollina, and UlisesGascon BlueN0r BlueN0r
ksanjeev284 ksanjeev284 mcollina mcollina UlisesGascon UlisesGascon
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation High
CVE-2026-87018 was published for undici (npm) Oct 27, 2026
benzdeus Credited to benzdeus, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering Moderate
CVE-2026-109932 was published for undici (npm) Oct 27, 2026
benzdeus Credited to benzdeus, UlisesGascon, and mcollina UlisesGascon UlisesGascon
mcollina mcollina
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor Moderate
CVE-2026-87029 was published for undici (npm) Oct 27, 2026
Yanhaoxi Credited to Yanhaoxi, mcollina, and UlisesGascon mcollina mcollina
UlisesGascon UlisesGascon
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length High
GHSA-f897-62hf-6gxq was published for @modelcontextprotocol/hono (npm) Oct 27, 2026
cybercraftsolutionsllc Credited to cybercraftsolutionsllc, hewei-gikaku, Jvr2022, Gal3m, mohammad228, shmulc8, JustasMonkev, and subchat hewei-gikaku hewei-gikaku
Jvr2022 Jvr2022 Gal3m Gal3m mohammad228 mohammad228 shmulc8 shmulc8 JustasMonkev JustasMonkev subchat subchat
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process High
CVE-2026-109413 was published for symfony/symfony (Composer) Oct 27, 2026
nicolas-grekas Credited to nicolas-grekas
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header High
CVE-2026-108082 was published for symfony/http-foundation (Composer) Oct 27, 2026
r3verii Credited to r3verii, nicolas-grekas, and duartecsantos nicolas-grekas nicolas-grekas
duartecsantos duartecsantos
Go JOSE: DoS when parsing JWKs that contain RSA keys High
CVE-2026-116587 was published for github.com/go-jose/go-jose/v3 (Go) Oct 27, 2026
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values High
CVE-2026-116683 was published for github.com/ctfer-io/terraform-provider-ctfd (Go) Oct 27, 2026
kta1kri Credited to kta1kri
Hydra legacy target blacklist permits unsafe PyYAML loading High
GHSA-wf6j-7hvr-gr93 was published for hydra-core (pip) Oct 27, 2026
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database