Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
57
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,188
pip
5,000+
Pub
14
RubyGems
1,167
Rust
1,625
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,581
Rust
21

1,625 advisories

Loading
russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation High
CVE-2026-116794 was published for russh (Rust) Oct 30, 2026
cataggar Credited to cataggar
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS) Low
CVE-2026-116775 was published for pageant (Rust) Oct 30, 2026
russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) Moderate
CVE-2026-116774 was published for russh (Rust) Oct 30, 2026
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages Low
CVE-2026-116696 was published for russh (Rust) Oct 30, 2026
Hama1cco Credited to Hama1cco
russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets Moderate
CVE-2026-116773 was published for russh (Rust) Oct 30, 2026
Hama1cco Credited to Hama1cco
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size High
CVE-2026-115907 was published for zip (Rust) Oct 29, 2026
Yeaseen Credited to Yeaseen
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. High
CVE-2026-115908 was published for zip (Rust) Oct 29, 2026
sl91994 Credited to sl91994
zip: AES Entry HMAC Authentication Bypass on Premature EOF Moderate
CVE-2026-115906 was published for zip (Rust) Oct 29, 2026
secstant-sigp Credited to secstant-sigp and Its-Just-Nans Its-Just-Nans Its-Just-Nans
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction High
CVE-2026-115909 was published for zip (Rust) Oct 29, 2026
kirk-baird Credited to kirk-baird, secstant-sigp, and li-jin-quan secstant-sigp secstant-sigp
li-jin-quan li-jin-quan
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence Low
GHSA-c33x-vcv4-vg3g was published for @cedar-policy/cedar-wasm (npm) Oct 29, 2026
john-h-kastner-aws Credited to john-h-kastner-aws and DenizParlak DenizParlak DenizParlak
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction Critical
CVE-2026-115893 was published for wasmtime (Rust) Oct 28, 2026
ilyas-mallah Credited to ilyas-mallah
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE Critical
CVE-2026-115905 was published for zip (Rust) Oct 28, 2026
ByGh00st Credited to ByGh00st and Pr0methean Pr0methean Pr0methean
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert Low
GHSA-vp88-798v-h67f was published for rustls (Rust) Oct 27, 2026
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share Low
GHSA-w44r-93j7-qv28 was published for rustls (Rust) Oct 27, 2026
Adam010341 Credited to Adam010341
Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs Moderate
GHSA-c8m5-c952-6cm4 was published for rustls (Rust) Oct 27, 2026
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. Low
GHSA-h2v8-394m-p7vv was published for rustls (Rust) Oct 27, 2026
Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type Moderate
CVE-2026-115892 was published for wasmtime (Rust) Oct 23, 2026
Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation Critical
CVE-2026-115889 was published for wasmtime (Rust) Oct 23, 2026
jaydns Credited to jaydns
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root Low
GHSA-h4fr-cmh5-qr62 was published for @fallow-cli/fallow-node (npm) Oct 23, 2026
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root Low
CVE-2026-115569 was published for @fallow-cli/fallow-node (npm) Oct 23, 2026
Tokio: Race condition in `tokio::time::Interval` Moderate
CVE-2026-115567 was published for tokio (Rust) Oct 23, 2026
ByteZ1337 Credited to ByteZ1337 and carabistouflette carabistouflette carabistouflette
gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options() High
GHSA-q54r-jf2p-rfr2 was published for gix (Rust) Oct 23, 2026
manus-use Credited to manus-use
Librsvg: Use-after-free when XML includes have duplicated entities High
CVE-2026-96889 was published for librsvg (Rust) Oct 22, 2026
ammonia: mXSS via MathML `annotation-xml` encoding strip Moderate
CVE-2026-63430 was published for ammonia (Rust) Oct 22, 2026
Ivan09999 Credited to Ivan09999
Slack Morphism verifier errors disclose valid HMACs in the logs Moderate
CVE-2026-113799 was published for slack-morphism (Rust) Oct 21, 2026
Ridful Credited to Ridful
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database