Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
109
GitHub Actions
55
Go
4,569
Maven
5,000+
npm
5,000+
NuGet
1,103
pip
5,000+
Pub
13
RubyGems
1,146
Rust
1,522
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

120 advisories

Loading
django CMS: Plugin move endpoint allows cyclic reparenting (DoS) High
CVE-2026-54623 was published for django-cms (pip) Aug 24, 2026
Zyy0530 Credited to Zyy0530, Str1ckl4nd, 7thParkk, and mauriceng98 Str1ckl4nd Str1ckl4nd
7thParkk 7thParkk mauriceng98 mauriceng98
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding High
CVE-2026-63202 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
Pig-Tail Credited to Pig-Tail
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary High
CVE-2026-63124 was published for io.netty.incubator:netty-incubator-codec-bhttp (Maven) Aug 20, 2026
sondt99 Credited to sondt99 and VuiVeIshere VuiVeIshere VuiVeIshere
nanoid: custom generators can loop indefinitely when size is zero High
CVE-2026-67213 was published for nanoid (npm) Jul 29, 2026
ai Credited to ai and dimaman2001 dimaman2001 dimaman2001
nanoid: non-secure generators can loop indefinitely with negative size High
CVE-2026-67214 was published for nanoid (npm) Jul 29, 2026
pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter) High
CVE-2026-59935 was published for pypdf (pip) Jul 23, 2026
koltiradw Credited to koltiradw and stefan6419846 stefan6419846 stefan6419846
pypdf: Possible infinite loop for not terminated inline images High
CVE-2026-59936 was published for pypdf (pip) Jul 23, 2026
koltiradw Credited to koltiradw and stefan6419846 stefan6419846 stefan6419846
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion High
CVE-2026-59933 was published for phpoffice/phpspreadsheet (Composer) Jul 23, 2026
sondt99 Credited to sondt99
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang High
CVE-2026-59901 was published for io.netty:netty-codec (Maven) Jul 22, 2026
Immutable.js `List` 32-bit trie overflow → unrecoverable DoS High
CVE-2026-59879 was published for immutable (npm) Jul 21, 2026
mateuszismyname Credited to mateuszismyname
node-tar: Negative tar entry size causes infinite loop in archive replace High
CVE-2026-59874 was published for tar (npm) Jul 20, 2026
Jvr2022 Credited to Jvr2022
json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS High
GHSA-xf7x-x43h-rpqh was published for json-repair (pip) Jul 13, 2026
Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry High
CVE-2026-47066 was published for hackney (Erlang) Jun 26, 2026
PJUllrich Credited to PJUllrich and maennchen maennchen maennchen
Concurrent Ruby : `AtomicReference#update` livelocks when the stored value is `Float::NAN` High
CVE-2026-54904 was published for concurrent-ruby (RubyGems) Jun 19, 2026
pranjalithakur Credited to pranjalithakur and EchoTydes EchoTydes EchoTydes
CoreWCF: Pre-authentication infinite-loop CPU exhaustion in CoreWCF net.tcp / net.pipe / net.uds framing handshake High
CVE-2026-54772 was published for CoreWCF.NetFramingBase (NuGet) Jun 19, 2026
image-size: JXL and HEIF parsers allow denial of service through infinite loops High
CVE-2025-71329 was published for image-size (npm) Jun 10, 2026
image-size: ICNS parser allows denial of service through an infinite loop High
CVE-2025-71330 was published for image-size (npm) Jun 10, 2026
OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body High
CVE-2026-49017 was published for swift (pip) May 27, 2026
Dasel: Denial of service in dasel selector lexer due to infinite loop on unterminated regex literal High
CVE-2026-46378 was published for github.com/tomwright/dasel/v3 (Go) May 19, 2026
kq5y Credited to kq5y
Bandit: Unauthenticated DoS via chunked request trailers in Bandit HTTP/1 decoder High
CVE-2026-39806 was published for bandit (Erlang) May 19, 2026
PJUllrich Credited to PJUllrich, mtrudel, and maennchen mtrudel mtrudel
maennchen maennchen
ImageMagick: Infinite Loop in the MIFF decoder can lead to CPU exhaustion High
CVE-2026-46522 was published for Magick.NET-Q16-AnyCPU (NuGet) May 18, 2026
bl4cksku11 Credited to bl4cksku11
Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability High
CVE-2026-42899 was published for Microsoft.AspNetCore.App.Runtime.linux-arm (NuGet) May 18, 2026
hamayanhamayan Credited to hamayanhamayan
iskorotkov/avro: CPU Exhaustion in Decoder High
CVE-2026-46385 was published for github.com/iskorotkov/avro/v2 (Go) May 18, 2026
klajok Credited to klajok
hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses High
GHSA-3v94-mw7p-v465 was published for hickory-net (Rust) May 7, 2026
Snappier has an infinite loop during SnappyStream decompression with malformed framed input High
CVE-2026-44302 was published for Snappier (NuGet) May 6, 2026
pawlos Credited to pawlos
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database