Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
108
GitHub Actions
54
Go
4,521
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,145
Rust
1,514
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
1
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
10

43 advisories

Loading
league/commonmark: Denial of service via deeply nested XML output Moderate
GHSA-mj63-m3rc-8ppr was published for league/commonmark (Composer) Aug 6, 2026
GrahamCampbell Credited to GrahamCampbell
UBB.threads is vulnerable to Denial of Service (DoS). By sending multiple concurrent requests to... High Unreviewed
CVE-2026-54224 was published Jun 18, 2026
Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of... Moderate Unreviewed
CVE-2026-8594 was published May 30, 2026
Nerdbank.MessagePack has a memory amplification DoS in collection deserialization Moderate
GHSA-qjvr-435c-5fjh was published for Nerdbank.MessagePack (NuGet) May 29, 2026
svenclaesson Credited to svenclaesson and AArnott AArnott AArnott
Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY... Moderate Unreviewed
CVE-2026-45557 was published May 19, 2026
Duplicate Advisory: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling Moderate
GHSA-36cp-mh65-x882 was published for openclaw (npm) Apr 10, 2026 • withdrawn
OpenClaw has incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant) Moderate
CVE-2026-35665 was published for openclaw (npm) Mar 30, 2026
Bitcoin Core through 29.0 allows a denial of service via a crafted transaction. Moderate Unreviewed
CVE-2025-46598 was published Mar 20, 2026
A series of specifically crafted, unauthenticated messages can exhaust available memory and crash... High Unreviewed
CVE-2026-25611 was published Feb 10, 2026
SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker... Moderate Unreviewed
CVE-2026-24324 was published Feb 10, 2026
SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted... High Unreviewed
CVE-2026-0485 was published Feb 10, 2026
An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the... Moderate Unreviewed
CVE-2025-49643 was published Dec 1, 2025
Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse High
CVE-2026-22774 was published for devalue (npm) Jan 15, 2026
jviide Credited to jviide, elliott-with-the-longest-name-on-github, and Rich-Harris elliott-with-the-longest-name-on-github elliott-with-the-longest-name-on-github
Rich-Harris Rich-Harris
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse High
CVE-2026-22775 was published for devalue (npm) Jan 15, 2026
jviide Credited to jviide, elliott-with-the-longest-name-on-github, and Rich-Harris elliott-with-the-longest-name-on-github elliott-with-the-longest-name-on-github
Rich-Harris Rich-Harris
Marshmallow has DoS in Schema.load(many) Moderate
CVE-2025-68480 was published for marshmallow (pip) Dec 22, 2025
SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security... Moderate Unreviewed
CVE-2025-42873 was published Dec 9, 2025
SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high... High Unreviewed
CVE-2025-42874 was published Dec 9, 2025
Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials... High Unreviewed
CVE-2025-42876 was published Dec 9, 2025
This High severity DoS (Denial of Service) vulnerability was introduced in version 2.0 of... High Unreviewed
CVE-2025-22166 was published Oct 21, 2025
Sigstore Timestamp Authority allocates excessive memory during request parsing High
CVE-2025-66564 was published for github.com/sigstore/timestamp-authority (Go) Dec 5, 2025
Fulcio allocates excessive memory during token parsing High
CVE-2025-66506 was published for github.com/sigstore/fulcio (Go) Dec 5, 2025
adeinega Credited to adeinega
net-imap rubygem vulnerable to possible DoS by memory exhaustion Moderate
CVE-2025-43857 was published for net-imap (RubyGems) Apr 28, 2025
Masamuneee Credited to Masamuneee and nevans nevans nevans
Querying for records within a specially crafted zone containing certain malformed DNSKEY records... High Unreviewed
CVE-2025-8677 was published Oct 22, 2025
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are ... Moderate Unreviewed
CVE-2025-26516 was published Sep 19, 2025
HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of... Moderate Unreviewed
CVE-2025-31987 was published Aug 15, 2025
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database