Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

2,437 advisories

Loading
vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts Moderate
CVE-2026-73557 was published for vllm (pip) Sep 4, 2026
hexcraft-labs Credited to hexcraft-labs and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m Moderate
CVE-2026-73556 was published for vllm (pip) Sep 4, 2026
CyberKareem Credited to CyberKareem and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages Moderate
CVE-2026-73555 was published for vllm (pip) Sep 4, 2026
biecho Credited to biecho and jperezdealgaba jperezdealgaba jperezdealgaba
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds Moderate
CVE-2026-71486 was published for vllm (pip) Sep 4, 2026
rexpository Credited to rexpository and jperezdealgaba jperezdealgaba jperezdealgaba
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff Moderate
CVE-2026-61663 was published for django-cms (pip) Aug 20, 2026
doanmanhducz Credited to doanmanhducz and nichoc0 nichoc0 nichoc0
Apache Airflow exposes deferred trigger kwargs in task-instance API responses Moderate
CVE-2026-49487 was published for apache-airflow (pip) Jul 7, 2026
Apache Airflow exposes sensitive JSON Variable values through the Bulk Variables API Moderate
CVE-2026-48828 was published for apache-airflow (pip) Jul 7, 2026
Apache Airflow exposes secrets backend credentials through the Config API Moderate
CVE-2026-48892 was published for apache-airflow (pip) Jul 7, 2026
Apache Airflow exposes unreadable DAG identifiers in the scheduling dependencies graph Moderate
CVE-2026-48891 was published for apache-airflow (pip) Jul 7, 2026
OpenHarness remote project-context commands allow persistent prompt poisoning Moderate
CVE-2026-56696 was published for openharness-ai (pip) Jun 23, 2026
Material for MkDocs: DOM XSS in search suggestions via query parameter Moderate
CVE-2026-73295 was published for mkdocs-material (pip) Sep 3, 2026
p- Credited to p-
PyOD persistence.load deserializes untrusted artifacts before validation Moderate
CVE-2026-15529 was published for pyod (pip) Jul 13, 2026
Withdrawn Advisory: Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint Moderate
CVE-2024-7034 was published for open-webui (pip) Mar 20, 2025 • withdrawn
Classic298 Credited to Classic298
Withdrawn Advisory: Open WebUI Access Control Moderate
CVE-2024-7040 was published for open-webui (pip) Mar 20, 2025 • withdrawn
Classic298 Credited to Classic298
Withdrawn Advisory: Open WebUI/ZDI-CAN-28259 Moderate
CVE-2026-0767 was published for open-webui (pip) Jan 23, 2026 • withdrawn
Classic298 Credited to Classic298
NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure Moderate
CVE-2026-63311 was published for nltk (pip) Sep 2, 2026
ekaf Credited to ekaf
Duplicate Advisory: nltk: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure Moderate
GHSA-qg9p-xrhj-435m was published for nltk (pip) Aug 22, 2026 • withdrawn
Natural Language Toolkit (NLTK) has unbounded recursion in JSONTaggedDecoder.decode_obj() may cause DoS Moderate
CVE-2026-66393 was published for nltk (pip) Mar 18, 2026
ZeroXJacks Credited to ZeroXJacks and SebTardif SebTardif SebTardif
Duplicate Advisory: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks Moderate
GHSA-3m7f-6hxv-6796 was published for nltk (pip) Aug 27, 2026 • withdrawn
Duplicate Advisory: NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely Moderate
GHSA-343m-9fqq-97c7 was published for nltk (pip) Aug 22, 2026 • withdrawn
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root Moderate
CVE-2026-71492 was published for banks (pip) Sep 2, 2026
spbavarva Credited to spbavarva
pypdf: Inefficient handling of non-whitespace inputs in read_until_whitespace Moderate
CVE-2026-82398 was published for pypdf (pip) Sep 2, 2026
arpitjain099 Credited to arpitjain099
NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y' Moderate
CVE-2026-81722 was published for nltk (pip) Sep 2, 2026
NLTK: Downloader.download follows hardlinks and overwrites outside-root files Moderate
CVE-2026-81727 was published for nltk (pip) Sep 2, 2026
Duplicate Advisory: Downloader.download follows hardlinks and overwrites outside-root files Moderate
GHSA-4xw3-jf9x-x7mf was published for nltk (pip) Aug 27, 2026 • withdrawn
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database