Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
122
GitHub Actions
64
Go
5,000+
Maven
5,000+
npm
5,000+
NuGet
1,236
pip
5,000+
Pub
14
RubyGems
1,213
Rust
1,627
Swift
64
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
20
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,595
Rust
25

37,837 advisories

Loading
NLTK: Quadratic-time CPU denial of service in CCG lexicon parser (fromstring) on wide bracket bodies and operator chains High
CVE-2026-126299 was published for nltk (pip) Nov 14, 2026
manus-use Credited to manus-use
NLTK: Quadratic-time CPU denial of service in Tree.chomsky_normal_form right-factor binarization via list.pop(0) High
CVE-2026-126298 was published for nltk (pip) Nov 14, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan High
CVE-2026-126297 was published for nltk (pip) Nov 14, 2026
manus-use Credited to manus-use
NLTK: BllipParser passes caller-supplied model paths to the bllipparser C extension with no pathsec check, enabling arbitrary read Moderate
CVE-2026-126295 was published for nltk (pip) Nov 13, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
ag-psd can exhaust memory when parsing crafted PSD dimensions High
CVE-2026-62297 was published for ag-psd (npm) Nov 13, 2026
joszamama Credited to joszamama
File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths Low
CVE-2026-62683 was published for github.com/filebrowser/filebrowser/v2 (Go) Nov 13, 2026
DavidCarliez Credited to DavidCarliez and hacdias hacdias hacdias
NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop Moderate
GHSA-gpwc-27cw-rh9r was published for nltk (pip) Nov 13, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop Moderate
CVE-2026-126300 was published for nltk (pip) Nov 13, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
NLTK: Unbounded CPU consumption in SteppingRecursiveDescentParser.parse() with ambiguous or self-embedding grammars High
CVE-2026-126303 was published for nltk (pip) Nov 13, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox High
CVE-2026-126304 was published for nltk (pip) Nov 13, 2026
manus-pi Credited to manus-pi and manus-use manus-use manus-use
SvelteKit: adapter-node crashes with an unhandled URIError when `reroute` rewrites malformed pathnames Moderate
CVE-2026-128117 was published for @sveltejs/kit (npm) Nov 13, 2026
SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static Moderate
CVE-2026-128121 was published for @sveltejs/adapter-static (npm) Nov 13, 2026
elliott-with-the-longest-name-on-github Credited to elliott-with-the-longest-name-on-github
SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare` Moderate
CVE-2026-128122 was published for @sveltejs/adapter-cloudflare (npm) Nov 13, 2026
elliott-with-the-longest-name-on-github Credited to elliott-with-the-longest-name-on-github and Rich-Harris Rich-Harris Rich-Harris
SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch` Moderate
CVE-2026-128123 was published for @sveltejs/adapter-node (npm) Nov 13, 2026
timhaines Credited to timhaines, elliott-with-the-longest-name-on-github, and Rich-Harris elliott-with-the-longest-name-on-github elliott-with-the-longest-name-on-github
Rich-Harris Rich-Harris
Tornado: Open redirect via triple-slash redirect paths Low
CVE-2026-126347 was published for tornado (pip) Nov 13, 2026
ezcache19 Credited to ezcache19, nyvexis1, AliAAlMousa, and kigma00 nyvexis1 nyvexis1
AliAAlMousa AliAAlMousa kigma00 kigma00
dnspython has excessive memory and CPU use High
CVE-2026-128089 was published for dnspython (pip) Nov 13, 2026
manus-use Credited to manus-use
Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes Moderate
CVE-2026-128077 was published for @nuxt/nitro-server (npm) Nov 13, 2026
kq5y Credited to kq5y
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http Moderate
CVE-2026-128080 was published for @opentelemetry/instrumentation-http (npm) Nov 13, 2026
klobucar Credited to klobucar
AutoMapper: Uncontrolled Recursion with Constructor Parameters High
CVE-2026-128082 was published for AutoMapper (NuGet) Nov 13, 2026
mcambria Credited to mcambria
russh kex_done: Shared-secret callback runs before server host-key verification Low
CVE-2026-128087 was published for russh (Rust) Nov 13, 2026
Yeaseen Credited to Yeaseen
russh try_sign: asynchronous confirmation can sign after agent lock Low
CVE-2026-128088 was published for russh (Rust) Nov 13, 2026
Yeaseen Credited to Yeaseen
OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification Moderate
CVE-2026-128086 was published for go.opentelemetry.io/otel/baggage (Go) Nov 13, 2026
alex131125 Credited to alex131125, pellared, and XSAM pellared pellared
XSAM XSAM
opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes Moderate
CVE-2026-128085 was published for go.opentelemetry.io/otel/sdk (Go) Nov 13, 2026
Hama1cco Credited to Hama1cco and pellared pellared pellared
sqlite3-ruby: Possible SQL query truncation when a string is 4 GiB or larger Moderate
CVE-2026-128084 was published for sqlite3 (RubyGems) Nov 13, 2026
luke-elttam Credited to luke-elttam
Laravel: Task Output Injection - Concurrency Process Low
CVE-2026-128083 was published for laravel/framework (Composer) Nov 13, 2026
Arr0way Credited to Arr0way
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database