Skip to content

GitHub Advisory Database

Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.

Filter advisories

Unreviewed advisories

Malware advisories

CC-BY-4.0 License
Language support
About GitHub Advisory Database
Filter advisories

Filter advisories

GitHub reviewed advisories
All reviewed
5,000+
Composer
5,000+
Erlang
116
GitHub Actions
55
Go
4,701
Maven
5,000+
npm
5,000+
NuGet
1,104
pip
5,000+
Pub
13
RubyGems
1,150
Rust
1,566
Swift
62
Unreviewed advisories
All unreviewed
5,000+
Malware advisories
All malware
5,000+
Composer
2
Go
18
Maven
2
npm
5,000+
NuGet
264
pip
5,000+
RubyGems
3,510
Rust
19

104 advisories

Loading
adawolfa/isdoc: Uncontrolled resource consumption (decompression bomb) when reading untrusted ISDOCX or PDF files Moderate
GHSA-xg43-5579-qw6v was published for adawolfa/isdoc (Composer) Jul 15, 2026
Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload High
CVE-2026-56755 was published for code.gitea.io/gitea (Go) Jul 21, 2026
AdamKorcz Credited to AdamKorcz
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion High
CVE-2026-59932 was published for phpoffice/phpspreadsheet (Composer) Jul 23, 2026
sondt99 Credited to sondt99
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling High
CVE-2026-59939 was published for httplib2 (pip) Jul 24, 2026
mauriceng98 Credited to mauriceng98
Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server Moderate
CVE-2026-55497 was published for github.com/cloudreve/Cloudreve/v3 (Go) Jul 24, 2026
riodrwn Credited to riodrwn
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C... High Unreviewed
CVE-2026-48586 was published Jul 27, 2026
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift... High Unreviewed
CVE-2026-49158 was published Jul 27, 2026
Apache Thrift Python bindings have an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability High
CVE-2026-41608 was published for thrift (pip) Jul 27, 2026
carlosfunk Credited to carlosfunk and oscerd oscerd oscerd
Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4... Moderate Unreviewed
CVE-2026-10819 was published Jul 27, 2026
Req vulnerable to unbounded archive/compression extraction triggered by response content-type High
CVE-2026-49755 was published for req (Erlang) Jul 29, 2026
PJUllrich Credited to PJUllrich and maennchen maennchen maennchen
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API... High Unreviewed
CVE-2026-68981 was published Aug 3, 2026
Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22... Moderate Unreviewed
CVE-2026-14298 was published Aug 13, 2026
In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the... Moderate Unreviewed
CVE-2026-75047 was published Aug 17, 2026
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS High
CVE-2026-53659 was published for org.http4k:http4k-core (Maven) Aug 17, 2026
Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when... Moderate Unreviewed
CVE-2026-18929 was published Aug 18, 2026
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting... High Unreviewed
CVE-2026-19671 was published Aug 18, 2026
Tanium addressed a compression bomb vulnerability in Findings. Low Unreviewed
CVE-2026-11617 was published Aug 19, 2026
Tanium addressed a compression bomb vulnerability in Threat Response. Low Unreviewed
CVE-2026-75476 was published Aug 19, 2026
exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory... High Unreviewed
CVE-2026-78206 was published Aug 24, 2026
gRPC Erlang package has unbounded gzip decompression (decompression bomb) High
CVE-2026-53430 was published for grpc (Erlang) Aug 25, 2026
PJUllrich Credited to PJUllrich and polvalente polvalente polvalente
http4s has HTTP/2 Denial of Service with Ember Backend High
CVE-2026-54556 was published for org.http4s:http4s-ember-core_2.12 (Maven) Aug 26, 2026
reardonj Credited to reardonj and rossabaker rossabaker rossabaker
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write.... High Unreviewed
CVE-2026-80189 was published Aug 26, 2026
The UnZipTransformer does not limit decompressed entry size or entry count when processing... Moderate Unreviewed
CVE-2026-59274 was published Aug 27, 2026
pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the... High Unreviewed
CVE-2026-82864 was published Aug 31, 2026
MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS Moderate
GHSA-rgwj-5xj2-c3m3 was published for mysql2 (npm) Aug 31, 2026
iaohkut-from-NightWolf-Team Credited to iaohkut-from-NightWolf-Team
ProTip! Advisories are also available from the GraphQL API
CC-BY-4.0 License
Language support
About GitHub Advisory Database